---
source: crates/ruff_linter/src/rules/flake8_bandit/mod.rs
---
S611 Use of `RawSQL` can lead to SQL injection vulnerabilities
 --> S611.py:5:27
  |
4 | User.objects.annotate(val=RawSQL('secure', []))
5 | User.objects.annotate(val=RawSQL('%secure' % 'nos', []))
  |                           ^^^^^^
6 | User.objects.annotate(val=RawSQL('{}secure'.format('no'), []))
7 | raw = '"username") AS "val" FROM "auth_user" WHERE "username"="admin" --'
  |

S611 Use of `RawSQL` can lead to SQL injection vulnerabilities
 --> S611.py:6:27
  |
4 | User.objects.annotate(val=RawSQL('secure', []))
5 | User.objects.annotate(val=RawSQL('%secure' % 'nos', []))
6 | User.objects.annotate(val=RawSQL('{}secure'.format('no'), []))
  |                           ^^^^^^
7 | raw = '"username") AS "val" FROM "auth_user" WHERE "username"="admin" --'
8 | User.objects.annotate(val=RawSQL(raw, []))
  |

S611 Use of `RawSQL` can lead to SQL injection vulnerabilities
  --> S611.py:8:27
   |
 6 | User.objects.annotate(val=RawSQL('{}secure'.format('no'), []))
 7 | raw = '"username") AS "val" FROM "auth_user" WHERE "username"="admin" --'
 8 | User.objects.annotate(val=RawSQL(raw, []))
   |                           ^^^^^^
 9 | raw = '"username") AS "val" FROM "auth_user"' \
10 |       ' WHERE "username"="admin" OR 1=%s --'
   |

S611 Use of `RawSQL` can lead to SQL injection vulnerabilities
  --> S611.py:11:27
   |
 9 | raw = '"username") AS "val" FROM "auth_user"' \
10 |       ' WHERE "username"="admin" OR 1=%s --'
11 | User.objects.annotate(val=RawSQL(raw, [0]))
   |                           ^^^^^^
12 | User.objects.annotate(val=RawSQL(sql='{}secure'.format('no'), params=[]))
13 | User.objects.annotate(val=RawSQL(params=[], sql='{}secure'.format('no')))
   |

S611 Use of `RawSQL` can lead to SQL injection vulnerabilities
  --> S611.py:12:27
   |
10 |       ' WHERE "username"="admin" OR 1=%s --'
11 | User.objects.annotate(val=RawSQL(raw, [0]))
12 | User.objects.annotate(val=RawSQL(sql='{}secure'.format('no'), params=[]))
   |                           ^^^^^^
13 | User.objects.annotate(val=RawSQL(params=[], sql='{}secure'.format('no')))
   |

S611 Use of `RawSQL` can lead to SQL injection vulnerabilities
  --> S611.py:13:27
   |
11 | User.objects.annotate(val=RawSQL(raw, [0]))
12 | User.objects.annotate(val=RawSQL(sql='{}secure'.format('no'), params=[]))
13 | User.objects.annotate(val=RawSQL(params=[], sql='{}secure'.format('no')))
   |                           ^^^^^^
   |
