diff options
| author | Tim Graham <timograham@gmail.com> | 2017-10-23 08:21:38 -0400 |
|---|---|---|
| committer | Tim Graham <timograham@gmail.com> | 2017-11-01 11:34:17 -0400 |
| commit | 6e8508734b070b30db9259b64bb748fb2a5a1bfb (patch) | |
| tree | 8b29c8839bfda8234af42b3587ce22547dfe5378 /docs/topics | |
| parent | 1e7dbbdec5ca2bd236b8ab64fa172a8fc0abcb1e (diff) | |
Described how querysets are protected from SQL injection in more detail.
Diffstat (limited to 'docs/topics')
| -rw-r--r-- | docs/topics/security.txt | 19 |
1 files changed, 11 insertions, 8 deletions
diff --git a/docs/topics/security.txt b/docs/topics/security.txt index 8d7b9c91f1..0eebdeb934 100644 --- a/docs/topics/security.txt +++ b/docs/topics/security.txt @@ -90,14 +90,17 @@ SQL injection is a type of attack where a malicious user is able to execute arbitrary SQL code on a database. This can result in records being deleted or data leakage. -By using Django's querysets, the resulting SQL will be properly escaped by -the underlying database driver. However, Django also gives developers power to -write :ref:`raw queries <executing-raw-queries>` or execute -:ref:`custom sql <executing-custom-sql>`. These capabilities should be used -sparingly and you should always be careful to properly escape any parameters -that the user can control. In addition, you should exercise caution when using -:meth:`~django.db.models.query.QuerySet.extra` and -:class:`~django.db.models.expressions.RawSQL`. +Django's querysets are protected from SQL injection since their queries are +constructed using query parameterization. A query's SQL code is defined +separately from the query's parameters. Since parameters may be user-provided +and therefore unsafe, they are escaped by the underlying database driver. + +Django also gives developers power to write :ref:`raw queries +<executing-raw-queries>` or execute :ref:`custom sql <executing-custom-sql>`. +These capabilities should be used sparingly and you should always be careful to +properly escape any parameters that the user can control. In addition, you +should exercise caution when using :meth:`~django.db.models.query.QuerySet.extra` +and :class:`~django.db.models.expressions.RawSQL`. Clickjacking protection ======================= |