are using django q objects (complex queries) with user input secure?

Question

Is it possible to inject a SQL attack in these queries? is it okay to insert user input in the query directly like below or it need a validation etap in advance :

    query = self.request.GET.get('q')
    query_result= Consultant.objects.filter(
            Q(first_name__icontains=query) |
            Q(last_name__icontains=query) |
            Q(group__title_techGroup__contains=query) |
            Q(practices__title_practice__contains=query)
        )

Yes, the `query` will be escaped before passing it to the database... — Willem Van Onsem, Sep 05 '22 at 11:07

score 0 · Accepted Answer · answered Sep 05 '22 at 11:07

0

Yes, they're just as secure as .filter() is in general (unless you explicitly use e.g. RawSQL or .extra() to sidestep all security and tell Django that You Know What You're Doing).

answered Sep 05 '22 at 11:07

AKX

152,115
15
115
172

are using django q objects (complex queries) with user input secure?

1 Answers1