I have a complex query, with some inner joins, a little where clause and HAVING clause too, this is for a report.
In this case, I can't use Model.objects.raw, so instead, I'm using cursor.execute(sql). My question is with my parameters. I have 20 parameters and some of them are repeated (company_id in every inner join).
Using a dict and %(key)s don't work here when using cursor.execute, it only works with Model.object.raw.
How can I name parameter, to just pass it once? Or is there a method to sanitize my entire query, avoiding SQL injection?
Pass all the 20 parameters and repeating them in order in a list is not readable.
According to Django documentation this is the right way to do it but WARNING it won't work on Sqlite
cursor.execute('SELECT * from Bla where id = %(some_id)s', {"some_id":1})