[Solved] You want to safely filter users by email domain using Django ORM. Which approach correctly prevents SQL injection?... user_domain = request.GET.get('domain') # Which code is safe? | Django

Django - Security Best Practices

You want to safely filter users by email domain using Django ORM. Which approach correctly prevents SQL injection?

user_domain = request.GET.get('domain')
# Which code is safe?
A) User.objects.filter(email__endswith=user_domain)
B) User.objects.raw(f"SELECT * FROM users WHERE email LIKE '%{user_domain}'")
C) User.objects.filter(email__endswith='%' + user_domain)
D) User.objects.raw("SELECT * FROM users WHERE email LIKE '%" + user_domain + "'")

AUser.objects.filter(email__endswith=user_domain)

BUser.objects.raw(f"SELECT * FROM users WHERE email LIKE '%{user_domain}'")

CUser.objects.filter(email__endswith='%' + user_domain)

DUser.objects.raw("SELECT * FROM users WHERE email LIKE '%" + user_domain + "'")

Step-by-Step Solution

Solution:

Step 1: Identify safe ORM filtering for email domain
Using filter() with email__endswith=user_domain safely escapes input and builds query.
Step 2: Analyze raw() and string concatenation risks
Options B and D use raw SQL with string interpolation, risking injection. User.objects.filter(email__endswith='%' + user_domain) incorrectly adds '%' in Python string, not ORM pattern.
Final Answer:
User.objects.filter(email__endswith=user_domain) -> Option A
Quick Check:
Use ORM filter with lookup for safe input handling = A [OK]

Quick Trick: Use ORM lookups like __endswith, avoid raw SQL with user input [OK]

Common Mistakes:

MISTAKES

Using raw SQL with user input directly
Adding SQL wildcards in Python strings
Ignoring ORM's safe query building

Master "Security Best Practices" in Django

9 interactive learning modes - each teaches the same concept differently

Learn Why Deep Visual Try Challenge Project Recall Perf

More Django Quizzes

You want to safely filter users by email domain using Django ORM. Which approach correctly prevents SQL injection?

Step 1: Identify safe ORM filtering for email domain

Step 2: Analyze raw() and string concatenation risks

Final Answer:

Quick Check:

Want More Practice?