Question

I am writing a django app and I know it handles string escaping and all to prevent sql injections in the queryset ( https://docs.djangoproject.com/en/dev/topics/security/ ).

Out of curiosity, I was wondering if there are still ways to perform sql injections on django apps? What would be an example?

Answer 1

Take a look at the Django documentation; it may be useful.

By using Django’s querysets, the resulting SQL will be properly
escaped by the underlying database driver. However, Django also gives
developers power to write raw queries or execute custom sql. These
capabilities should be used sparingly and you should always be careful
to properly escape any parameters that the user can control. In
addition, you should exercise caution when using extra().