From 79d6e402e3a19490f2ab2c24cbe4b416ee8926e7 Mon Sep 17 00:00:00 2001 From: Russell Keith-Magee Date: Mon, 21 Dec 2009 01:53:39 +0000 Subject: [PATCH] Fixed #12409 -- Corrected some documentation typos in the docs on raw querysets. Also added a missing __init__.py file. Thanks to Alex Gaynor for the reports. git-svn-id: http://code.djangoproject.com/svn/django/trunk@11924 bcc190cf-cafb-0310-a4f2-bffc1f526a37 --- docs/topics/db/sql.txt | 4 ++-- tests/modeltests/raw_query/__init__.py | 0 2 files changed, 2 insertions(+), 2 deletions(-) create mode 100644 tests/modeltests/raw_query/__init__.py diff --git a/docs/topics/db/sql.txt b/docs/topics/db/sql.txt index 57834eb98a..45aa4f950e 100644 --- a/docs/topics/db/sql.txt +++ b/docs/topics/db/sql.txt @@ -154,13 +154,13 @@ parameters from the ``params`` list. It's tempting to write the above query as:: - >>> query = 'SELECT * FROM myapp_person WHERE last_name = %s', % lname + >>> query = 'SELECT * FROM myapp_person WHERE last_name = %s' % lname >>> Person.objects.raw(query) **Don't.** Using the ``params`` list completely protects you from `SQL injection - attacks`__`, a common exploit where attackers inject arbitrary SQL into + attacks`__, a common exploit where attackers inject arbitrary SQL into your database. If you use string interpolation, sooner or later you'll fall victim to SQL injection. As long as you remember to always use the ``params`` list you'll be protected. diff --git a/tests/modeltests/raw_query/__init__.py b/tests/modeltests/raw_query/__init__.py new file mode 100644 index 0000000000..e69de29bb2