Skip to content

Commit

Permalink
Fixed #12409 -- Corrected some documentation typos in the docs on raw…
Browse files Browse the repository at this point in the history
… querysets. Also added a missing __init__.py file. Thanks to Alex Gaynor for the reports.

git-svn-id: http://code.djangoproject.com/svn/django/trunk@11924 bcc190cf-cafb-0310-a4f2-bffc1f526a37
  • Loading branch information
freakboy3742 committed Dec 21, 2009
1 parent c804179 commit 79d6e40
Show file tree
Hide file tree
Showing 2 changed files with 2 additions and 2 deletions.
4 changes: 2 additions & 2 deletions docs/topics/db/sql.txt
Expand Up @@ -154,13 +154,13 @@ parameters from the ``params`` list.

It's tempting to write the above query as::

>>> query = 'SELECT * FROM myapp_person WHERE last_name = %s', % lname
>>> query = 'SELECT * FROM myapp_person WHERE last_name = %s' % lname
>>> Person.objects.raw(query)

**Don't.**

Using the ``params`` list completely protects you from `SQL injection
attacks`__`, a common exploit where attackers inject arbitrary SQL into
attacks`__, a common exploit where attackers inject arbitrary SQL into
your database. If you use string interpolation, sooner or later you'll
fall victim to SQL injection. As long as you remember to always use the
``params`` list you'll be protected.
Expand Down
Empty file.

0 comments on commit 79d6e40

Please sign in to comment.