use orm instead of plain sql