diff options
| author | Erik Romijn <eromijn@solidlinks.nl> | 2014-04-20 16:25:39 -0400 |
|---|---|---|
| committer | Tim Graham <timograham@gmail.com> | 2014-04-21 18:29:39 -0400 |
| commit | 34526c2f56b863c2103655a0893ac801667e86ea (patch) | |
| tree | 0325faf6cd632874a79c74653eeb95a7c97135d4 /docs/ref/models | |
| parent | 380545bf85cbf17fc698d136815b7691f8d023ca (diff) | |
[1.7.x] Fixed queries that may return unexpected results on MySQL due to typecasting.
This is a security fix. Disclosure will follow shortly.
Backport of 75c0d4ea3ae48970f788c482ee0bd6b29a7f1307 from master
Diffstat (limited to 'docs/ref/models')
| -rw-r--r-- | docs/ref/models/querysets.txt | 10 |
1 files changed, 10 insertions, 0 deletions
diff --git a/docs/ref/models/querysets.txt b/docs/ref/models/querysets.txt index 4de02bf0d9..0f9ef88c25 100644 --- a/docs/ref/models/querysets.txt +++ b/docs/ref/models/querysets.txt @@ -1202,6 +1202,16 @@ of the arguments is required, but you should use at least one of them. Entry.objects.extra(where=['headline=%s'], params=['Lennon']) +.. warning:: + + If you are performing queries on MySQL, note that MySQL's silent type coercion + may cause unexpected results when mixing types. If you query on a string + type column, but with an integer value, MySQL will coerce the types of all values + in the table to an integer before performing the comparison. For example, if your + table contains the values ``'abc'``, ``'def'`` and you query for ``WHERE mycolumn=0``, + both rows will match. To prevent this, perform the correct typecasting + before using the value in a query. + defer ~~~~~ |