[Solved] Identify the error in this Django ORM code that tries to prevent SQL injection: query = "SELECT * FROM users WHERE username = '%s'" % user_input users = User.objects.raw(query) | Django

Django - Security Best Practices

Identify the error in this Django ORM code that tries to prevent SQL injection:

query = "SELECT * FROM users WHERE username = '%s'" % user_input
users = User.objects.raw(query)

AThe raw() method automatically escapes inputs, so no error.

BUsing raw SQL with string formatting allows SQL injection.

CThe filter() method should be used instead of raw().

DThe query string is missing parameter placeholders.

Step-by-Step Solution

Solution:

Step 1: Analyze string formatting with user input
Using % formatting inserts user_input directly, risking SQL injection.
Step 2: Understand raw() method behavior
raw() executes raw SQL without escaping, so injection risk remains.
Final Answer:
Using raw SQL with string formatting allows SQL injection. -> Option B
Quick Check:
String formatting + raw() = injection risk = A [OK]

Quick Trick: Never build raw SQL with string formatting; use ORM methods [OK]

Common Mistakes:

MISTAKES

Master "Security Best Practices" in Django

9 interactive learning modes - each teaches the same concept differently

More Django Quizzes

Identify the error in this Django ORM code that tries to prevent SQL injection: