dhacker.in · Django ORM kwargs lab

Orders report

Signed in as an Acme Corp analyst (tenant 1). You may see Acme's orders for active customers only.

Report parameters

Try: active_customer (normal) zz (harmless custom name) z -- (SQL comment) z" (stray quote)

Result

Request
-
HTTP status the API returns
-
API response has sql field
-
Press Run.

Lab inspector: SQL the database received

Press Run.
Recorded server-side by the lab with connection.execute_wrapper. It is not part of the app's API response.
Code under review: reports/views.py of this app