Ticket #14733: 14733-xof.diff

trunk/docs/topics/db/sql.txt

@@ -56 +56 @@
     :attr:`~Options.db_table` option, which also lets you manually set the
     database table name.
 
+.. admonition:: Statements permitted in ``.raw()`` queries
+
+    No checking is done on the SQL statement that is passed in to ``.raw()``.
+    Django expects that the statement will return a set of rows from the
+    database, but does nothing to enforce that. If the query does not
+    return rows, a (possibly cryptic) error will result.
+
 Of course, this example isn't very exciting -- it's exactly the same as
 running ``Person.objects.all()``. However, ``raw()`` has a bunch of other
 options that make it very powerful.

trunk/django/db/models/sql/query.py

@@ -31 +31 @@
     """
 
     def __init__(self, sql, using, params=None):
-        self.validate_sql(sql)
         self.params = params or ()
         self.sql = sql
         self.using = using
@@ -62 +61 @@
         return [converter(column_meta[0])
                 for column_meta in self.cursor.description]
 
-    def validate_sql(self, sql):
-        if not sql.lower().strip().startswith('select'):
-            raise InvalidQuery('Raw queries are limited to SELECT queries. Use '
-                               'connection.cursor directly for other types of queries.')
-
     def __iter__(self):
         # Always execute a new query for a new iterator.
         # This could be optimized with a cache at the expense of RAM.