Hacker News new | ask | show | jobs
by mmclar 6 days ago
SQLalchemy does that. One advantage of the Django syntax is that it can be (pretty much) directly dropped into a query string on any admin page or DRF query and filter the results. E.g. the admin page for all the events after noon today:

  admin/event/?end__gt=2026-07-26T12:00:00
Being able to do ad-hoc queries using the same paradigm your app queries are written in, and then pass urls around with those queries included (e.g., quick one-off reports or answers to client questions) is so helpful.
1 comments

This convenience sounds a little dangerous. Would this allow the user to specify e.g. joins or SQL procedure calls using the query parameter?
If you mean “would it allow arbitrary queries in the admin interface?”, then yes, it would. That’s why it’s the admin interface.

If you mean “would it allow arbitrary queries from normal view code”, then no it would not—not unless you string eval on the backend or something else dangerous.