mysql - Django 应用程序上的 SQL 注入(inject)

Question

我正在编写一个 Django 应用程序，我知道它处理字符串转义以及所有这些都是为了防止查询集中的 SQL 注入(inject) (https://docs.djangoproject.com/en/dev/topics/security/)。

出于好奇，我想知道是否还有方法可以在 django 应用程序上执行 sql 注入(inject)？什么是示例？

Answer 1

Take a look at the Django documentation ;它可能会有用。

By using Django's querysets, the resulting SQL will be properly escaped by the underlying database driver. However, Django also gives developers power to write raw queries or execute custom sql. These capabilities should be used sparingly and you should always be careful to properly escape any parameters that the user can control. In addition, you should exercise caution when using extra().