3 ms·
You can't avoid use user input. How would you login with a username and password without user input? Django's ORM will sanitize input when you pass it in as ra
by collyw 8y ago
You can't avoid use user input. How would you login with a username and password without user input?
Django's ORM will sanitize input when you pass it in as raw SQL.
- megous 8y agoSQL query is a string. (that's where you don't pass the user input, not even quoted/escaped, as a policy) User input is passed "out of band", meaning not as a part of the query string. How exactly that happens depends on the RDBMS's particular client/server interface. That's all that's enough to avoid SQL injections. And it has nothing to do with ORM.