Fix SQL Injection (Legacy & Modern) in Django
Django's ORM is designed to prevent SQL injection by default, but developers often introduce critical vulnerabilities when bypassing the ORM for 'performance' or complex legacy queries. Whether you are using .raw() or connection.cursor(), the core failure is the same: treating untrusted user input as executable SQL code through string formatting.
The Vulnerable Pattern
# DANGEROUS: Using f-strings or % formatting in raw queries from django.db import connectiondef get_user_vulnerable(request): user_id = request.GET.get(‘id’) # Vulnerable to: 1 OR 1=1 query = f”SELECT * FROM users WHERE id = {user_id}” return User.objects.raw(query)
def legacy_cursor_vulnerable(username): with connection.cursor() as cursor: # Vulnerable to string interpolation cursor.execute(“SELECT * FROM users WHERE username = ‘%s’” % username) return cursor.fetchone()
The Secure Implementation
The vulnerability stems from string concatenation where the database engine cannot distinguish between the SQL command and the data. By using placeholders (%s) and passing parameters as a separate list, you utilize 'Parameterized Queries'. Django's database backend ensures these parameters are escaped or sent via a separate protocol (PreparedStatement), making it impossible for input like '1; DROP TABLE users' to be executed as code.
# SECURE: Using Django ORM or Parameterized Queries from django.db import connectiondef get_user_secure(request): user_id = request.GET.get(‘id’) # 1. Best Practice: Use the ORM return User.objects.filter(id=user_id)
def get_user_raw_secure(user_id): # 2. Secure Raw: Use params argument (Placeholders) return User.objects.raw(“SELECT * FROM users WHERE id = %s”, [user_id])
def secure_cursor(username): with connection.cursor() as cursor: # 3. Secure Cursor: Database driver handles escaping cursor.execute(“SELECT * FROM users WHERE username = %s”, [username]) return cursor.fetchone()
Your Django API
might be exposed to SQL Injection (Legacy & Modern)
74% of Django apps fail this check. Hackers use automated scanners to find this specific flaw. Check your codebase before they do.
Free Tier • No Credit Card • Instant Report
Verified by Ghost Labs Security Team
This content is continuously validated by our automated security engine and reviewed by our research team. Ghost Labs analyzes over 500+ vulnerability patterns across 40+ frameworks to provide up-to-date remediation strategies.