SQL Injection- How it works

The value of "title" parameter in query string is "' OR 'a'='a"

Code:
qry = "SELECT * FROM books_book WHERE title='%s'" % (title)
book = Book.objects.raw(qry)

Generated query by django is:
SELECT * FROM books_book WHERE title='' OR 'a'='a'
And it is displaying all books

1. hogfather
2. color of magic

Click here to see how to avoid SQL Injection in Django

Click here to see how to avoid SQL Injection in HTML file