Django - Security Best Practices
Given this code snippet:
user_input = "1; DROP TABLE users;"
User.objects.filter(id=user_input)
What happens when this runs?
Given this code snippet: user_input = "1; DROP TABLE users;" User.objects.filter(id=user_input) What happens when this runs?
medium📝 Predict Output Q5 of 15
Step-by-Step Solution
Solution:
Step 1: Understand parameter handling in filter()
Input is passed as a parameter, not executed as SQL.Step 2: Assess risk of injection
SQL injection does not occur; dangerous input is treated as a string.Final Answer:
The ORM safely treats input as a parameter, no table is dropped -> Option CQuick Check:
Parameter safety = No injection [OK]
Quick Trick: Dangerous input is safe with ORM filters [OK]
Common Mistakes:
MISTAKES- Believing input runs as SQL commands
- Expecting errors from semicolons in input
Master "Security Best Practices" in Django
Want More Practice?
15+ quiz questions · All difficulty levels · Free
Free Signup - Practice All QuestionsMore Django Quizzes