Django: APIs prone to SQL Injection

By YGN Ethical Hacker Group - March 25, 2018

.extra

For example, this use of extra():

>>> qs.extra(
...     select={'val': "select col from sometable where othercol = %s"},
...     select_params=(someparam,),
... )

is equivalent to:

>>> qs.annotate(val=RawSQL("select col from sometable where othercol = %s", (someparam,)))

.raw

https://docs.djangoproject.com/en/dev/topics/db/sql/

>>> for p in Person.objects.raw('SELECT * FROM myapp_person'):
...     print(p)
John Smith
Jane Jones

.execute

do_sql

from django.db import connection

cursor = connection.cursor()
cursor.execute('insert into table (column) values (%s)', (dinosaur,))
cursor.close()

from handy.db import do_sql

do_sql('insert into table (column) values (%s)', (dinosaur,))

RawSQL

>>> from django.db.models.expressions import RawSQL
>>> queryset.annotate(val=RawSQL("select col from sometable where othercol = %s", (someparam,)))

seckb*