SQL Injection Prevention with the ORM

The Unsafe Way: Raw String SQL

Concatenating user input directly into a SQL string lets an attacker inject their own SQL. If username came from a form as ' OR 1='1, the query's meaning changes completely. This pattern should never be used.

Warning: This example shows what NOT to do -- it is vulnerable to SQL injection and is only here for comparison.

Example: The Unsafe Way: Raw String SQL

Concatenating user input directly into a SQL string lets an attacker inject their own SQL. If username came from a form as ' OR 1='1, the query's meaning changes completely. This pattern should never be used.

# UNSAFE -- do not do this:
# query = "SELECT * FROM auth_user WHERE username = '" + username + "'"
# cursor.execute(query)
#
# If username is: ' OR '1'='1
# the query becomes true for every row in the table.

The Safe Way: The ORM

Django's QuerySet methods like .filter() never insert values directly into the SQL text. Instead, the value is passed as a separate parameter to the database driver, so it's always treated as plain data, never as part of the SQL command.

Note: The ORM is safe by default -- you get this protection just by using .filter() normally.

Example: The Safe Way: The ORM

Django's QuerySet methods like .filter() never insert values directly into the SQL text. Instead, the value is passed as a separate parameter to the database driver, so it's always treated as plain data, never as part of the SQL command.

from django.contrib.auth.models import User

# Safe: username is passed as a parameter, not concatenated
username = request.POST.get('username')
matches = User.objects.filter(username=username)

Parameterized Raw SQL, When You Need It

Occasionally raw SQL is unavoidable. Django's .raw() and cursor.execute() support %s placeholders with a separate parameters list, keeping the same safety guarantee as the ORM.

Example: Parameterized Raw SQL, When You Need It

Occasionally raw SQL is unavoidable. Django's .raw() and cursor.execute() support %s placeholders with a separate parameters list, keeping the same safety guarantee as the ORM.

from django.db import connection

def find_user(username):
    with connection.cursor() as cursor:
        cursor.execute(
            'SELECT id, username FROM auth_user WHERE username = %s',
            [username],
        )
        return cursor.fetchone()