mirror of
https://github.com/django/django.git
synced 2025-07-05 10:19:20 +00:00
[soc2009/multidb] Merged up to trunk r11924.
git-svn-id: http://code.djangoproject.com/svn/django/branches/soc2009/multidb@11925 bcc190cf-cafb-0310-a4f2-bffc1f526a37
This commit is contained in:
parent
576b641c51
commit
8da7538b18
@ -80,7 +80,7 @@ def find_template_loader(loader):
|
|||||||
module, attr = loader.rsplit('.', 1)
|
module, attr = loader.rsplit('.', 1)
|
||||||
try:
|
try:
|
||||||
mod = import_module(module)
|
mod = import_module(module)
|
||||||
except ImportError:
|
except ImportError, e:
|
||||||
raise ImproperlyConfigured('Error importing template source loader %s: "%s"' % (loader, e))
|
raise ImproperlyConfigured('Error importing template source loader %s: "%s"' % (loader, e))
|
||||||
try:
|
try:
|
||||||
TemplateLoader = getattr(mod, attr)
|
TemplateLoader = getattr(mod, attr)
|
||||||
|
@ -154,13 +154,13 @@ parameters from the ``params`` list.
|
|||||||
|
|
||||||
It's tempting to write the above query as::
|
It's tempting to write the above query as::
|
||||||
|
|
||||||
>>> query = 'SELECT * FROM myapp_person WHERE last_name = %s', % lname
|
>>> query = 'SELECT * FROM myapp_person WHERE last_name = %s' % lname
|
||||||
>>> Person.objects.raw(query)
|
>>> Person.objects.raw(query)
|
||||||
|
|
||||||
**Don't.**
|
**Don't.**
|
||||||
|
|
||||||
Using the ``params`` list completely protects you from `SQL injection
|
Using the ``params`` list completely protects you from `SQL injection
|
||||||
attacks`__`, a common exploit where attackers inject arbitrary SQL into
|
attacks`__, a common exploit where attackers inject arbitrary SQL into
|
||||||
your database. If you use string interpolation, sooner or later you'll
|
your database. If you use string interpolation, sooner or later you'll
|
||||||
fall victim to SQL injection. As long as you remember to always use the
|
fall victim to SQL injection. As long as you remember to always use the
|
||||||
``params`` list you'll be protected.
|
``params`` list you'll be protected.
|
||||||
|
0
tests/modeltests/raw_query/__init__.py
Normal file
0
tests/modeltests/raw_query/__init__.py
Normal file
Loading…
x
Reference in New Issue
Block a user