Skip to content

[pull] main from django:main#325

Merged
pull[bot] merged 3 commits intothreatcode:mainfrom
django:main
Mar 13, 2026
Merged

[pull] main from django:main#325
pull[bot] merged 3 commits intothreatcode:mainfrom
django:main

Conversation

@pull
Copy link

@pull pull bot commented Mar 13, 2026

See Commits and Changes for more details.


Created by pull[bot] (v2.0.0-alpha.4)

Can you help keep this open source service alive? 💖 Please sponsor : )

emmanuel-ferdman and others added 3 commits March 12, 2026 19:57
…eholder_sql.

The lack of ability of the get_placeholder call chain to return SQL and
parameters separated so they can be mogrified by the backend at execution time
forced implementations to dangerously interpolate potentially user controlled
values.

The get_placeholder_sql name was chosen due to its proximity to the previous
method, but other options such as Field.as_sql were considered but ultimately
rejected due to its different input signature compared to Expression.as_sql
that might have lead to confusion.

There is a lot of overlap between what Field.get_db_prep_value and
get_placeholder_sql do but folding the latter in the former would require
changing its return signature to return expression which is a way more invasive
change than what is proposed here.

Given we always call get_db_prep_value it might still be an avenue worth
exploring in the future to offer a publicly documented interface to allow field
to take an active part in the compilation chain.

Thanks Jacob for the review.
@pull pull bot locked and limited conversation to collaborators Mar 13, 2026
@pull pull bot added the ⤵️ pull label Mar 13, 2026
@pull pull bot merged commit d43bd46 into threatcode:main Mar 13, 2026
@pull pull bot added the ⤵️ pull label Mar 13, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants