[Fixed]-SQL injection hacks and django

If you use querysets, django will escape your variables automatically. If you use RAW queries or things like the .extra method you’ll have to take extra care and for example use parameter binding. More information about the whole thing can be found here (also very good resource about other security concerns).