how to pass user input into raw sql query ?

[leb dev]

i have a django project that is connected to sql server  database i am trying to write a select query   #convert the Django ORM into SQL query

    print("sql query  = ",FilterQuery.query)

 

select * from table name where filed name = user input 

can anyone help me with this?

[Bhoopesh sisoudiya]

Hi Lev dev,

Write your query like this 

sqlRawQuery = "Your query ... Field name= {}".format (userInput)

Thanks

Bhoopesh Kumar

 

--
You received this message because you are subscribed to the Google Groups "Django users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to django-users...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/django-users/fa888770-2a9a-4ff6-951b-be085c15cda8%40googlegroups.com.

[Daniel Roseman]

On Friday, 6 September 2019 20:39:58 UTC+1, Bhoopesh sisoudiya wrote:

Hi Lev dev,

Write your query like this 

sqlRawQuery = "Your query ... Field name= {}".format (userInput)

Thanks

Bhoopesh Kumar

 

No. Do **not** do this, ever. 

Use SQL parameters: 

    query = 'SELECT * FROM whatever WHERE name = %s'

    cursor.execute(query, (user_input,))

Bhoopesh please stop giving bad unsafe advice like this. 

--

Daniel. 

[David Grant]

Bhoopesh

The reason is that the user input could be used to do something dangerous.... It's called SQL injection. The solution be Daniel prevents this. Look it up...

Dave

[Mario R. Osorio]

Do not use string interpolation as proposed by Bhoopesh!!!

Take a look at:

• SQL injection
  
• SQL injection protection and
  
• Passing parameters into raw()
  

[testdevleb]

Sent from my Samsung Galaxy smartphone.

I tried daniel solution and this was right.