[Solved] Consider this Django view snippet: def my_view(request): username = request.GET.get('username') user = User.objects.... | Django

Django - Security Best Practices

Consider this Django view snippet:

def my_view(request):
    username = request.GET.get('username')
    user = User.objects.raw(f"SELECT * FROM auth_user WHERE username = '{username}'")
    return HttpResponse('User found')

What is the main security risk here?

ASQL injection due to unsafe raw query with user input

BCross-Site Scripting (XSS) from unescaped output

CCSRF attack because no token is checked

DNo risk; this is safe Django code

Step-by-Step Solution

Solution:

Step 1: Analyze the raw SQL query usage
The code uses raw SQL with string formatting including user input directly, which is unsafe.
Step 2: Identify the vulnerability type
This allows attackers to inject SQL commands, causing SQL injection attacks.
Final Answer:
SQL injection due to unsafe raw query with user input -> Option A
Quick Check:
Raw SQL with user input = SQL injection risk [OK]

Quick Trick: Avoid raw SQL with user input; use ORM or parameterized queries [OK]

Common Mistakes:

MISTAKES

Confusing SQL injection with XSS
Assuming CSRF applies to GET requests
Thinking raw SQL is safe if used in Django

Master "Security Best Practices" in Django

9 interactive learning modes - each teaches the same concept differently

Learn Why Deep Visual Try Challenge Project Recall Perf

More Django Quizzes

Consider this Django view snippet:

Step 1: Analyze the raw SQL query usage

Step 2: Identify the vulnerability type

Final Answer:

Quick Check:

Want More Practice?