Raw Sql Injection Risk (ARCH2055)

Key python.orm.raw-sql-injection-risk · Severity error · Category orm

Building raw SQL via string interpolation or concatenation is both an injection vector and a query-plan-cache buster. Always use bound parameters.

Incorrect

def find(email):
    return User.objects.raw(f"SELECT * FROM users WHERE email = '{email}'")

Correct

def find(email):
    return User.objects.raw("SELECT * FROM users WHERE email = %s", [email])

Fix

Pass user input into raw SQL as bound parameters (%s with a params list), never via interpolation.