SQL Injection (SQLi) is one of the most dangerous classes of web vulnerabilities. Thankfully, it’s becoming increasingly rare — thanks mostly to increasing use of database abstraction layers like Django’s ORM — but where it occurs it can be devastating. SQLi happens when code incorrectly constructs SQL queries that contain user input. 
Django’s ORM uses parameterized statements everywhere, so it is highly resistant to SQLi. Thus, if you’re using the ORM to make database queries you can be fairly confident that your app is safe.

However, there are still a few cases where you need to be aware of injection attacks; a very small minority of APIs are not 100% safe. These are where you should focus your auditing, and where your automated code analysis should focus its checks.
1. Raw Queries : Occasionally, the ORM isn’t expressive enough, and you need raw SQL. Before you do, consider whether there are ways to avoid it
2. AVOID: Queryset.extra()
3. Always pass parameterized statements — even if your parameter list is empty
spam lang_mismatch pii not_appropriate hate_speech sexual_content quality toxicity humor creativity violence