[Django]-Is it safe to query Django ORM directly with the user input?

4👍

From the docs

“Django’s querysets are protected from SQL injection since their queries are constructed using query parameterization. A query’s SQL code is defined separately from the query’s parameters. Since parameters may be user-provided and therefore unsafe, they are escaped by the underlying database driver.”

Leave a comment