How does Django protect against SQL injection by default?
- A By escaping all output
- B The ORM parameterises every query
- C By blocking suspicious IP addresses
- D By validating form input only
Answer
The ORM parameterises every query
Values are always passed as query parameters. Protection is lost when using raw() or extra() with string formatting of user input.





