From 7bf3ba0d0c700670d13d7683eec7bd3eb3d4dd1f Mon Sep 17 00:00:00 2001
From: petedmarsh <petedmarsh@users.noreply.github.com>
Date: Thu, 21 Jul 2016 15:28:31 +0100
Subject: [PATCH] Fixed #26899 -- Documented why RawSQL params is a required
 parameter.

---
 docs/ref/models/expressions.txt | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/docs/ref/models/expressions.txt b/docs/ref/models/expressions.txt
index a07b57e815..667285adbb 100644
--- a/docs/ref/models/expressions.txt
+++ b/docs/ref/models/expressions.txt
@@ -459,7 +459,9 @@ should avoid them if possible.
 
     You should be very careful to escape any parameters that the user can
     control by using ``params`` in order to protect against :ref:`SQL injection
-    attacks <sql-injection-protection>`.
+    attacks <sql-injection-protection>`. ``params`` is a required argument to
+    force you to acknowledge that you're not interpolating your SQL with user
+    provided data.
 
 .. currentmodule:: django.db.models