mirror of
https://github.com/django/django.git
synced 2025-07-04 17:59:13 +00:00
[soc2009/multidb] Merged up to trunk r11924.
git-svn-id: http://code.djangoproject.com/svn/django/branches/soc2009/multidb@11925 bcc190cf-cafb-0310-a4f2-bffc1f526a37
This commit is contained in:
parent
576b641c51
commit
8da7538b18
@ -80,7 +80,7 @@ def find_template_loader(loader):
|
||||
module, attr = loader.rsplit('.', 1)
|
||||
try:
|
||||
mod = import_module(module)
|
||||
except ImportError:
|
||||
except ImportError, e:
|
||||
raise ImproperlyConfigured('Error importing template source loader %s: "%s"' % (loader, e))
|
||||
try:
|
||||
TemplateLoader = getattr(mod, attr)
|
||||
|
@ -154,13 +154,13 @@ parameters from the ``params`` list.
|
||||
|
||||
It's tempting to write the above query as::
|
||||
|
||||
>>> query = 'SELECT * FROM myapp_person WHERE last_name = %s', % lname
|
||||
>>> query = 'SELECT * FROM myapp_person WHERE last_name = %s' % lname
|
||||
>>> Person.objects.raw(query)
|
||||
|
||||
**Don't.**
|
||||
|
||||
Using the ``params`` list completely protects you from `SQL injection
|
||||
attacks`__`, a common exploit where attackers inject arbitrary SQL into
|
||||
attacks`__, a common exploit where attackers inject arbitrary SQL into
|
||||
your database. If you use string interpolation, sooner or later you'll
|
||||
fall victim to SQL injection. As long as you remember to always use the
|
||||
``params`` list you'll be protected.
|
||||
|
0
tests/modeltests/raw_query/__init__.py
Normal file
0
tests/modeltests/raw_query/__init__.py
Normal file
Loading…
x
Reference in New Issue
Block a user