Documentation for raw() and extra() should warn about SQL injection

[Sasha Romijn]

Using the ​raw() and ​extra() methods can result in SQL injection vulnerabilities, if not used carefully. However, the documentation does not mention this. The ​Security in Django document does include a warning regarding raw() and extra(), but I think a SQL injection is potentially so severe that we should also note this in the documentation for raw() and extra() itself.

[Tim Graham]

extra() does say "Always use params instead of embedding values directly into where because params will ensure values are quoted correctly according to your particular backend. For example, quotes will be escaped correctly." but I agree this warning is not very prominent.

[Tim Graham <timograham@…>]

In 3776926cfe503f16c7195621da20c5b89bda70a2:

Fixed #22493 - Added warnings to raw() and extra() docs about SQL injection

Thanks Erik Romijn for the suggestion.

[Tim Graham <timograham@…>]

In 2b0e9aa57d4c5b5dbad7d300b4e383d384941034:

[1.6.x] Fixed #22493 - Added warnings to raw() and extra() docs about SQL injection

Thanks Erik Romijn for the suggestion.

Backport of 3776926cfe503f16c7195621da20c5b89bda70a2 from master

[Tim Graham <timograham@…>]

In ae1535606145df9c858d4c5a5a2d9a9cff9f3992:

[1.7.x] Fixed #22493 - Added warnings to raw() and extra() docs about SQL injection

Thanks Erik Romijn for the suggestion.

Backport of 3776926cfe from master