1
0
mirror of https://github.com/django/django.git synced 2025-07-04 17:59:13 +00:00

[soc2009/multidb] Merged up to trunk r11924.

git-svn-id: http://code.djangoproject.com/svn/django/branches/soc2009/multidb@11925 bcc190cf-cafb-0310-a4f2-bffc1f526a37
This commit is contained in:
Alex Gaynor 2009-12-21 02:01:24 +00:00
parent 576b641c51
commit 8da7538b18
3 changed files with 3 additions and 3 deletions

View File

@ -80,7 +80,7 @@ def find_template_loader(loader):
module, attr = loader.rsplit('.', 1)
try:
mod = import_module(module)
except ImportError:
except ImportError, e:
raise ImproperlyConfigured('Error importing template source loader %s: "%s"' % (loader, e))
try:
TemplateLoader = getattr(mod, attr)

View File

@ -154,13 +154,13 @@ parameters from the ``params`` list.
It's tempting to write the above query as::
>>> query = 'SELECT * FROM myapp_person WHERE last_name = %s', % lname
>>> query = 'SELECT * FROM myapp_person WHERE last_name = %s' % lname
>>> Person.objects.raw(query)
**Don't.**
Using the ``params`` list completely protects you from `SQL injection
attacks`__`, a common exploit where attackers inject arbitrary SQL into
attacks`__, a common exploit where attackers inject arbitrary SQL into
your database. If you use string interpolation, sooner or later you'll
fall victim to SQL injection. As long as you remember to always use the
``params`` list you'll be protected.

View File