#26899: Document why RawSQL requires parameters
-------------------------------------+-------------------------------------
Reporter: wolever | Owner:
Type: | petedmarsh
Cleanup/optimization | Status: closed
Component: Documentation | Version: master
Severity: Normal | Resolution: fixed
Keywords: | Triage Stage: Ready for
| checkin
Has patch: 1 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 1 | UI/UX: 0
-------------------------------------+-------------------------------------
Comment (by jarshwah):
I can understand your frustration. There's certainly an inconsistency
here, which is unfortunate, but I think I'd prefer to make the raw and
extra params a necessary argument if I was writing them from scratch given
the argument made earlier. It's way too easy to slip in a % (format) and
just ignore the params argument altogether. All parameters should be
passed via params, whether they're potentially injectable or not.
I consider the overhead involved in adding an empty params argument a
decent tradeoff to have a reminder of good security practises built into
the API and not just within the docs. RawSQL will probably not be used
very much within projects so it shouldn't lead to any/much API fatigue.
--
Ticket URL: <https://code.djangoproject.com/ticket/26899#comment:11>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To post to this group, send email to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/065.75f07ea308209ba0198fa9078141a6f3%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.
