Parametrize UPDATE, DELETE and bulk operations #1785
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
henadzit
commented
Nov 24, 2024
| @@ -76,6 +77,11 @@ def to_db_time( | |||
| return None | |||
|
|
|||
|
|
|||
| # Converts Decimal to string for sqlite in cases where it's hard to know the | |||
| # related field, e.g. in raw queries, math or annotations. | |||
| sqlite3.register_adapter(Decimal, str) | |||
There was a problem hiding this comment.
Django uses the same approach https://github.com/django/django/blob/857b1048d53ebf5fc5581c110e85c212b81ca83a/django/db/backends/sqlite3/base.py#L55
Pull Request Test Coverage Report for Build 12116346174Details
💛 - Coveralls |
henadzit
force-pushed
the
feat/parametrize-other-queries
branch
from
843cecc to
fa7c374
Compare
henadzit
commented
Nov 28, 2024
| 0.22.1 | ||
| ------ | ||
| Fixed | ||
| ^^^^^ | ||
| - Fix unable to use ManyToManyField if OneToOneField passed as Primary Key (#1783) | ||
| - Fix sorting by Term (e.g. RawSQL) (#1788) | ||
|
|
||
| Changed | ||
| ^^^^^^^ | ||
| - Parametrizes SELECT queries including `.count()`, `.exists()`, `.values()`, `.values_list()` (#1777) |
There was a problem hiding this comment.
We released this with 0.22.1 too 🙃 I'll be updating CHANGELOG from now on in my PR to avoid missing things like that.
|
@abondar can you have a look at this? Thanks! |
abondar
previously approved these changes
Dec 2, 2024
waketzheng
approved these changes
Dec 2, 2024
Merged
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
It's a follow up to #1777.
We will also need to parametrize fetching of m2m fields, prefetching, etc. but these are not posing security risks. I'll do them as a separate PR.
Motivation and Context
Parameterized queries are crucial for preventing SQL injection attacks and but also can improve performance of database operations.
Related ticket #81
v1.0.0 target #19
How Has This Been Tested?
Checklist: