django - allowing arbitrary user inputted data to be entered to filter() - is this secure?

As far as I know (I haven't looked into the django's admin source code deeply enoug开发者_如何学编程h to figure out) Django's admin translates GET query parameters directly to the query filter conditions.

I was wondering, is this approach secure enough to be used in user-facing application? I have a list of data, that has to accept arbitrary WHERE clauses, and I'm thinking of implementing it by converting the GET parameters into a dictionary so that it can be passed into the filter() method of the queryset.

---

Yes.

The input will be escaped, so there can be no SQL injection attacks or anything similar. However the input might be invalid for the field(s) you are searching on. Or it may make no sense at all, so it is a good idea to do some form of validation (like the input date must be bigger than some other date, the input value must be smaller than X, etc)

However, if you want to display the data you received from the user as part of a page, you need to make sure to escape it properly. Documentation on the autoescape tag

---

I think the correct answer is "No, it's not safe"

http://www.djangoproject.com/weblog/2010/dec/22/security/

Django just released security fixes to 1.2.4 and 1.3b1 preventing users from constructing arbitrary query filter. With sufficient knowledge of the underlying data model and usage of regular expressions, arbitrary information, such as user's password hash, can be extracted.