Skip to content

Fixed #24638 -- Added QuerySet.comment() to inject SQL comments.#19

Open
hbrooks wants to merge 5 commits into
mainfrom
demo/pr-21226
Open

Fixed #24638 -- Added QuerySet.comment() to inject SQL comments.#19
hbrooks wants to merge 5 commits into
mainfrom
demo/pr-21226

Conversation

@hbrooks
Copy link
Copy Markdown

@hbrooks hbrooks commented May 28, 2026

dcsid added 5 commits May 21, 2026 18:49
QuerySet.comment(message) emits an /* ... */ comment in the resulting SELECT or UPDATE statement: after the leading SELECT (and DISTINCT, if present), after UPDATE, or as a leading block before a UNION/INTERSECT/EXCEPT combinator.

comment() raises ValueError if the message contains '/*' or '*/' to prevent SQL comment injection, and TypeError if the message is not a string.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants