SQL injection hacks and django

Dean picture Dean · Jul 24, 2010 · Viewed 11.9k times · Source

Coming from a jsp and servlet background I am interested to know how django copes with SQL injection hacks. As a servlet and jsp developer I would use prepared statements which gives me some form of protection. How does django cope with custom queries, for example a custom search field.

Answer

KillianDS picture KillianDS · Jul 24, 2010

If you use querysets, django will escape your variables automatically. If you use RAW queries or things like the .extra method you'll have to take extra care and for example use parameter binding. More information about the whole thing can be found here (also very good resource about other security concerns).