id	summary	reporter	owner	description	type	status	component	version	severity	resolution	keywords	cc	stage	has_patch	needs_docs	needs_tests	needs_better_patch	easy	ui_ux
29493	Block strings from being passed to `__in`	Christian Ledermann	nobody	"ORM: [fieldname]__in when passed a string iterates over digits of the string

Can be reproduced in a virgin new project with `django-admin startproject mysite`
Django version 1.11.13, python version 2.7
Databases tested: PostgreSQL and sqlite3

Observed behaviour:
{{{
(Pdb) from django.contrib.auth import get_user_model
(Pdb) User = get_user_model()
(Pdb) query = User.objects.filter(id__in='1234567890')
(Pdb) print query.query
SELECT ""auth_user"".""id"", ""auth_user"".""password"", ""auth_user"".""last_login"", ""auth_user"".""is_superuser"", ""auth_user"".""username"", ""auth_user"".""first_name"", ""auth_user"".""last_name"", ""auth_user"".""email"", ""auth_user"".""is_staff"", ""auth_user"".""is_active"", ""auth_user"".""date_joined"" FROM ""auth_user"" WHERE ""auth_user"".""id"" IN (0, 1, 2, 3, 4, 5, 6, 7, 8, 9)

}}}
Expected Behaviour:
An error is raised "	New feature	closed	Database layer (models, ORM)	1.11	Normal	wontfix			Unreviewed	0	0	0	0	0	0