security injection ai_generated true

SQL injection via ORM raw query — parameterization bypassed

ID: security/sql-injection-orm-raw-query

Also available as: JSON · Markdown
92%Fix Rate
93%Confidence
4Evidence
2023-01-01First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
any active — — —

Root Cause

Using ORM raw query with string formatting instead of parameterized queries.

generic

Workarounds

  1. 95% success Always use parameterized queries, even in ORM raw mode 
    Model.objects.raw('SELECT * FROM t WHERE id = %s', [user_id])

    Sources: https://docs.djangoproject.com/en/5.0/topics/db/sql/#passing-parameters-into-raw

  2. 90% success Use ORM query builder methods instead of raw SQL 
    Model.objects.filter(id=user_id)

    Sources: https://docs.djangoproject.com/en/5.0/topics/db/queries/

Dead Ends

Common approaches that don't work:

  1. Escape user input with custom string replacement 90% fail

    Custom escaping always misses edge cases

  2. Use a WAF to block SQL injection patterns 70% fail

    WAFs can be bypassed with encoding tricks