Kaydet (Commit) 79d6e402 authored tarafından Russell Keith-Magee's avatar Russell Keith-Magee

Fixed #12409 -- Corrected some documentation typos in the docs on raw querysets.…

Fixed #12409 -- Corrected some documentation typos in the docs on raw querysets. Also added a missing __init__.py file. Thanks to Alex Gaynor for the reports.

git-svn-id: http://code.djangoproject.com/svn/django/trunk@11924 bcc190cf-cafb-0310-a4f2-bffc1f526a37
üst c8041791
......@@ -154,13 +154,13 @@ parameters from the ``params`` list.
It's tempting to write the above query as::
>>> query = 'SELECT * FROM myapp_person WHERE last_name = %s', % lname
>>> query = 'SELECT * FROM myapp_person WHERE last_name = %s' % lname
>>> Person.objects.raw(query)
**Don't.**
Using the ``params`` list completely protects you from `SQL injection
attacks`__`, a common exploit where attackers inject arbitrary SQL into
attacks`__, a common exploit where attackers inject arbitrary SQL into
your database. If you use string interpolation, sooner or later you'll
fall victim to SQL injection. As long as you remember to always use the
``params`` list you'll be protected.
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment