diff --git a/docs/topics/security.txt b/docs/topics/security.txt index 8d7b9c91f1d..0eebdeb9349 100644 --- a/docs/topics/security.txt +++ b/docs/topics/security.txt @@ -90,14 +90,17 @@ SQL injection is a type of attack where a malicious user is able to execute arbitrary SQL code on a database. This can result in records being deleted or data leakage. -By using Django's querysets, the resulting SQL will be properly escaped by -the underlying database driver. However, Django also gives developers power to -write :ref:`raw queries ` or execute -:ref:`custom sql `. These capabilities should be used -sparingly and you should always be careful to properly escape any parameters -that the user can control. In addition, you should exercise caution when using -:meth:`~django.db.models.query.QuerySet.extra` and -:class:`~django.db.models.expressions.RawSQL`. +Django's querysets are protected from SQL injection since their queries are +constructed using query parameterization. A query's SQL code is defined +separately from the query's parameters. Since parameters may be user-provided +and therefore unsafe, they are escaped by the underlying database driver. + +Django also gives developers power to write :ref:`raw queries +` or execute :ref:`custom sql `. +These capabilities should be used sparingly and you should always be careful to +properly escape any parameters that the user can control. In addition, you +should exercise caution when using :meth:`~django.db.models.query.QuerySet.extra` +and :class:`~django.db.models.expressions.RawSQL`. Clickjacking protection =======================