SQL injection protection via ORM in Django - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

How does Django ORM protect against SQL injection?

Which of the following best explains how Django ORM prevents SQL injection attacks?

A It automatically escapes query parameters and uses parameterized queries internally.

B It disables all raw SQL queries by default to avoid injection.

C It requires developers to manually sanitize all inputs before queries.

D It encrypts all database queries before sending them to the database.

💡 Hint

Think about how query parameters are handled inside the ORM.

Django ORM uses parameterized queries which safely separate data from code, preventing injection.

❓ component_behavior

intermediate

Output of a Django ORM filter with user input

Given the code below, what will be the output if user_input = "1 OR 1=1"?

Django

user_input = "1 OR 1=1"
results = MyModel.objects.filter(id=user_input)
print(results.query)

A Empty queryset because filter fails

B SELECT ... WHERE id = 1 OR 1=1 (unsafe, injection possible)

C SyntaxError due to invalid filter argument

D SELECT ... WHERE id = '1 OR 1=1' (safe, no injection)

💡 Hint

Look at how Django ORM treats filter parameters as values, not code.

Django ORM treats the filter value as a literal string, escaping it properly, so the query is safe.

📝 Syntax

advanced

Identify the unsafe raw SQL usage in Django

Which option shows unsafe raw SQL usage vulnerable to SQL injection?

A MyModel.objects.filter(name=user_input)

B MyModel.objects.raw("SELECT * FROM myapp_mymodel WHERE name = %s", [user_input])

C MyModel.objects.raw(f"SELECT * FROM myapp_mymodel WHERE name = '{user_input}'")

D MyModel.objects.get(pk=user_input)

💡 Hint

Look for string formatting inside raw SQL queries.

Option C directly inserts user input into the SQL string, allowing injection.

🔧 Debug

advanced

Why does this Django raw query cause SQL injection?

Consider this code snippet:

query = "SELECT * FROM myapp_mymodel WHERE username = '%s'" % user_input
results = MyModel.objects.raw(query)

What is the main problem here?

A The raw() method does not support parameterized queries.

B User input is directly inserted into the query string without escaping.

C The query uses single quotes instead of double quotes.

D The query string is missing a WHERE clause.

💡 Hint

Think about how string formatting works with user input.

Using string formatting inserts user input directly, allowing malicious SQL code to run.

❓ state_output

expert

Result count after filtering with unsafe input in Django ORM

Given the model Product with integer field id, and this code:

user_input = "1 OR 1=1"
qs = Product.objects.filter(id=user_input)
count = qs.count()

What is the value of count if the database has 5 products with ids 1 to 5?

A 0 because no product has id '1 OR 1=1'

B 5 because the input causes SQL injection returning all rows

C 1 because it matches product with id 1

D Raises a ValueError due to invalid integer filter

💡 Hint

Consider how Django ORM treats filter values and the field type.

Django ORM treats the input as a string and tries to match it exactly. Since '1 OR 1=1' is not a valid integer, no rows match.