No, this is by design. Without a man-in-the-middle attack, there is no way for an attacker to send a CSRF token cookie to a victim’s browser, so a successful attack would need to obtain the victim’s browser’s cookie via XSS or similar, in which case an attacker usually doesn’t need CSRF attacks.

Some security audit tools flag this as a problem but as mentioned before, an attacker cannot steal a user’s browser’s

CSRF cookie. “Stealing” or modifying your own token using Firebug, Chrome dev tools, etc. isn’t a vulnerability.

Is it a problem that Django’s CSRF protection isn’t linked to a session by default?

No, this is by design. Not linking CSRF protection to a session allows using the protection on sites such as a pastebin that allow submissions from anonymous users which don’t have a session.

If you wish to store the CSRF token in the user’s session, use the

CSRF_USE_SESSIONS

setting.

Why might a user encounter a CSRF validation failure after logging in?

For security reasons, CSRF tokens are rotated each time a user logs in. Any page with a form generated before a login will have an old, invalid CSRF token and need to be reloaded. This might happen if a user uses the back button after a login or if they log in in a different browser tab.

Databases

Django attempts to support as many features as possible on all database backends. However, not all database backends are alike, and we’ve had to make design decisions on which features to support and which assumptions we can make safely.

This file describes some of the features that might be relevant to Django usage. Of course, it is not intended as a replacement for server-specific documentation or reference manuals.

General notes

Persistent connections

Persistent connections avoid the overhead of re-establishing a connection to the database in each request. They’re controlled by the

CONN_MAX_AGE

parameter which defines the maximum lifetime of a connection. It can be set independently for each database.

962 Chapter 6. API Reference

Django Documentation, Release 2.0.dev20170914110741

The default value is 0, preserving the historical behavior of closing the database connection at the end of each request.

To enable persistent connections, set

CONN_MAX_AGE

to a positive number of seconds. For unlimited persistent connections, set it to None.

Connection management

Django opens a connection to the database when it first makes a database query. It keeps this connection open and reuses it in subsequent requests. Django closes the connection once it exceeds the maximum age defined by

CONN_MAX_AGE

or when it isn’t usable any longer.

In detail, Django automatically opens a connection to the database whenever it needs one and doesn’t have one already

— either because this is the first connection, or because the previous connection was closed.

At the beginning of each request, Django closes the connection if it has reached its maximum age. If your database terminates idle connections after some time, you should set

CONN_MAX_AGE

to a lower value, so that Django doesn’t attempt to use a connection that has been terminated by the database server. (This problem may only affect very low traffic sites.)

At the end of each request, Django closes the connection if it has reached its maximum age or if it is in an unrecoverable error state. If any database errors have occurred while processing the requests, Django checks whether the connection still works, and closes it if it doesn’t. Thus, database errors affect at most one request; if the connection becomes unusable, the next request gets a fresh connection.

Caveats

Since each thread maintains its own connection, your database must support at least as many simultaneous connections as you have worker threads.

Sometimes a database won’t be accessed by the majority of your views, for example because it’s the database of an external system, or thanks to caching. In such cases, you should set

CONN_MAX_AGE

to a low value or even 0, because it doesn’t make sense to maintain a connection that’s unlikely to be reused. This will help keep the number of simultaneous connections to this database small.

The development server creates a new thread for each request it handles, negating the effect of persistent connections.

Don’t enable them during development.

When Django establishes a connection to the database, it sets up appropriate parameters, depending on the backend being used. If you enable persistent connections, this setup is no longer repeated every request. If you modify parameters such as the connection’s isolation level or time zone, you should either restore Django’s defaults at the end of each request, force an appropriate value at the beginning of each request, or disable persistent connections.

Encoding

Django assumes that all databases use UTF-8 encoding. Using other encodings may result in unexpected behavior such as “value too long” errors from your database for data that is valid in Django. See the database specific notes below for information on how to set up your database correctly.

PostgreSQL notes

Django supports PostgreSQL 9.3 and higher.

psycopg2 2.5.4 or higher is required, though the latest release is recommended.

6.7. Databases 963

Django Documentation, Release 2.0.dev20170914110741

PostgreSQL connection settings

See

HOST

for details.

Optimizing PostgreSQL’s configuration

Django needs the following parameters for its database connections:

• client_encoding: 'UTF8',

• default_transaction_isolation: 'read committed' by default, or the value set in the connection options (see below),

• timezone: 'UTC' when

USE_TZ

is True, value of

TIME_ZONE

otherwise.

If these parameters already have the correct values, Django won’t set them for every new connection, which improves performance slightly. You can configure them directly in postgresql.conf or more conveniently per database user with ALTER ROLE .

Django will work just fine without this optimization, but each new connection will do some additional queries to set these parameters.

Isolation level

Like PostgreSQL itself, Django defaults to the READ COMMITTED isolation level . If you need a higher isolation level such as REPEATABLE READ or SERIALIZABLE, set it in the

OPTIONS

part of your database configuration in

DATABASES

import

psycopg2.extensions

DATABASES = {

# ...

'OPTIONS' : {

'isolation_level' : psycopg2.extensions.ISOLATION_LEVEL_SERIALIZABLE,

}

Note: Under higher isolation levels, your application should be prepared to handle exceptions raised on serialization failures. This option is designed for advanced uses.

Indexes for varchar and text columns

When specifying db_index=True on your model fields, Django typically outputs a single CREATE INDEX statement. However, if the database type for the field is either varchar or text (e.g., used by CharField,

FileField

, and TextField), then Django will create an additional index that uses an appropriate PostgreSQL operator class for the column. The extra index is necessary to correctly perform lookups that use the LIKE operator in their SQL, as is done with the contains and startswith lookup types.

Migration operation for adding extensions

If you need to add a PostgreSQL extension (like hstore, postgis, etc.) using a migration, use the

CreateExtension

operation.

964 Chapter 6. API Reference

Django Documentation, Release 2.0.dev20170914110741

Server-side cursors

When using

QuerySet.iterator()

, Django opens a

server-side cursor . By default, PostgreSQL assumes that only the first 10% of the results of cursor queries will be fetched. The query planner spends less time planning the query and starts returning results faster, but this could diminish performance if more than 10% of the results are retrieved. PostgreSQL’s assumptions on the number of rows retrieved for a cursor query is controlled with the cursor_tuple_fraction option.

Transaction pooling and server-side cursors

Using a connection pooler in transaction pooling mode (e.g.

pgBouncer ) requires disabling server-side cursors for that connection.

Server-side cursors are local to a connection and remain open at the end of a transaction when

AUTOCOMMIT

is True.

A subsequent transaction may attempt to fetch more results from a server-side cursor. In transaction pooling mode, there’s no guarantee that subsequent transactions will use the same connection. If a different connection is used, an error is raised when the transaction references the server-side cursor, because server-side cursors are only accessible in the connection in which they were created.

One solution is to disable server-side cursors for a connection in

DATABASES

by setting

DISABLE_SERVER_SIDE_CURSORS

to True.

To benefit from server-side cursors in transaction pooling mode, you could set up

another connection to the database

in order to perform queries that use server-side cursors. This connection needs to either be directly to the database or to a connection pooler in session pooling mode.

Another option is to wrap each QuerySet using server-side cursors in an

atomic()

block, because it disables autocommit for the duration of the transaction. This way, the server-side cursor will only live for the duration of the transaction.

Manually-specifying values of auto-incrementing primary keys

Django uses PostgreSQL’s SERIAL data type to store auto-incrementing primary keys. A SERIAL column is populated with values from a sequence that keeps track of the next available value. Manually assigning a value to an auto-incrementing field doesn’t update the field’s sequence, which might later cause a conflict. For example:

>>>

from

django.contrib.auth.models

import

User

>>> User.objects.create(username= 'alice' , pk= 1 )

<User: alice>

>>> # The sequence hasn't been updated; its next value is 1.

>>> User.objects.create(username= 'bob' )

...

IntegrityError: duplicate key value violates unique constraint

"auth_user_pkey" DETAIL: Key (id)=(1) already exists.

If you need to specify such values, reset the sequence afterwards to avoid reusing a value that’s already in the table.

The

sqlsequencereset

management command generates the SQL statements to do that.

Test database templates

You can use the

TEST['TEMPLATE']

setting to specify a template (e.g. 'template0') from which to create a test database.

6.7. Databases 965

Django Documentation, Release 2.0.dev20170914110741

Speeding up test execution with non-durable settings

You can speed up test execution times by configuring PostgreSQL to be non-durable .

Warning: This is dangerous: it will make your database more susceptible to data loss or corruption in the case of a server crash or power loss. Only use this on a development machine where you can easily restore the entire contents of all databases in the cluster.

MySQL notes

Version support

Django supports MySQL 5.5 and higher.

Django’s inspectdb feature uses the information_schema database, which contains detailed data on all database schemas.

Django expects the database to support Unicode (UTF-8 encoding) and delegates to it the task of enforcing transactions and referential integrity. It is important to be aware of the fact that the two latter ones aren’t actually enforced by

MySQL when using the MyISAM storage engine, see the next section.

Storage engines

MySQL has several storage engines . You can change the default storage engine in the server configuration.

Until MySQL 5.5.4, the default engine was MyISAM

. The main drawbacks of MyISAM are that it doesn’t support

transactions or enforce foreign-key constraints. On the plus side, it was the only engine that supported full-text indexing and searching until MySQL 5.6.4.

Since MySQL 5.5.5, the default storage engine is InnoDB . This engine is fully transactional and supports foreign key references. It’s probably the best choice at this point. However, note that the InnoDB autoincrement counter is lost on a MySQL restart because it does not remember the AUTO_INCREMENT value, instead recreating it as “max(id)+1”.

This may result in an inadvertent reuse of

AutoField

values.

If you upgrade an existing project to MySQL 5.5.5 and subsequently add some tables, ensure that your tables are using the same storage engine (i.e. MyISAM vs. InnoDB). Specifically, if tables that have a ForeignKey between them use different storage engines, you may see an error like the following when running migrate:

_mysql_exceptions.OperationalError: (

1005 , "Can't create table '\\db_name\\.#sql-4a8_ab' (errno: 150)"

)

MySQL DB API Drivers

MySQL has a couple drivers that implement the Python Database API described in PEP 249 :

• mysqlclient is a native driver. It’s the recommended choice.

• MySQL Connector/Python is a pure Python driver from Oracle that does not require the MySQL client library or any Python modules outside the standard library.

Unless this was changed by the packager of your MySQL package. We’ve had reports that the Windows Community Server installer sets up

InnoDB as the default storage engine, for example.

966 Chapter 6. API Reference

Django Documentation, Release 2.0.dev20170914110741

These drivers are thread-safe and provide connection pooling.

In addition to a DB API driver, Django needs an adapter to access the database drivers from its ORM. Django provides an adapter for mysqlclient while MySQL Connector/Python includes its own .

mysqlclient

Django requires mysqlclient 1.3.3 or later.

MySQL Connector/Python

MySQL Connector/Python is available from the download page . The Django adapter is available in versions 1.1.X

and later. It may not support the most recent releases of Django.

Time zone definitions

If you plan on using Django’s

timezone support , use

mysql_tzinfo_to_sql to load time zone tables into the MySQL database. This needs to be done just once for your MySQL server, not per database.

Creating your database

You can create your database using the command-line tools and this SQL:

CREATE DATABASE <dbname> CHARACTER SET utf8;

This ensures all tables and columns will use UTF-8 by default.

Collation settings

The collation setting for a column controls the order in which data is sorted as well as what strings compare as equal. It can be set on a database-wide level and also per-table and per-column. This is documented thoroughly in the MySQL documentation. In all cases, you set the collation by directly manipulating the database tables; Django doesn’t provide a way to set this on the model definition.

By default, with a UTF-8 database, MySQL will use the utf8_general_ci collation. This results in all string equality comparisons being done in a case-insensitive manner. That is, "Fred" and "freD" are considered equal at the database level. If you have a unique constraint on a field, it would be illegal to try to insert both "aa" and

"AA" into the same column, since they compare as equal (and, hence, non-unique) with the default collation. If you want case-sensitive comparisons on a particular column or table, change the column or table to use the utf8_bin collation.

Please note that according to MySQL Unicode Character Sets , comparisons for the utf8_general_ci collation are faster, but slightly less correct, than comparisons for utf8_unicode_ci. If this is acceptable for your application, you should use utf8_general_ci because it is faster. If this is not acceptable (for example, if you require German dictionary order), use utf8_unicode_ci because it is more accurate.

Warning: Model formsets validate unique fields in a case-sensitive manner. Thus when using a case-insensitive collation, a formset with unique field values that differ only by case will pass validation, but upon calling save(), an IntegrityError will be raised.

6.7. Databases 967

Django Documentation, Release 2.0.dev20170914110741

Connecting to the database

Refer to the

settings documentation .

Connection settings are used in this order:

3. MySQL option files.

In other words, if you set the name of the database in

OPTIONS

, this will take precedence over

NAME

, which would

override anything in a MySQL option file .

Here’s a sample configuration which uses a MySQL option file:

# settings.py

DATABASES = {

'default' : {

'ENGINE' : 'django.db.backends.mysql' ,

'OPTIONS' : {

'read_default_file' : '/path/to/my.cnf' ,

}

# my.cnf

[client] database = NAME user = USER password = PASSWORD default-character- set

utf8

Several other MySQLdb connection options may be useful, such as ssl, init_command, and sql_mode.

Setting sql_mode

From MySQL 5.7 onwards and on fresh installs of MySQL 5.6, the default value of the sql_mode option contains STRICT_TRANS_TABLES. That option escalates warnings into errors when data are truncated upon insertion, so Django highly recommends activating a strict mode for MySQL to prevent data loss (either

STRICT_TRANS_TABLES or STRICT_ALL_TABLES).

If you need to customize the SQL mode, you can set the sql_mode variable like other MySQL options: either in a config file or with the entry 'init_command':

"SET sql_mode='STRICT_TRANS_TABLES'" in the

OPTIONS

part of your database configuration in

DATABASES

Isolation level

When running concurrent loads, database transactions from different sessions (say, separate threads handling different requests) may interact with each other. These interactions are affected by each session’s transaction isolation level . You can set a connection’s isolation level with an 'isolation_level' entry in the

OPTIONS

part of your database configuration in

DATABASES

. Valid values for this entry are the four standard isolation levels:

• 'read uncommitted'

• 'read committed'

968 Chapter 6. API Reference

Django Documentation, Release 2.0.dev20170914110741

• 'repeatable read'

• 'serializable' or None to use the server’s configured isolation level. However, Django works best with and defaults to read committed rather than MySQL’s default, repeatable read. Data loss is possible with repeatable read.

In older versions, the MySQL database backend defaults to using the database’s isolation level (which defaults to repeatable read) rather than read committed.

Creating your tables

When Django generates the schema, it doesn’t specify a storage engine, so tables will be created with whatever default storage engine your database server is configured for. The easiest solution is to set your database server’s default storage engine to the desired engine.

If you’re using a hosting service and can’t change your server’s default storage engine, you have a couple of options.

• After the tables are created, execute an ALTER TABLE statement to convert a table to a new storage engine

(such as InnoDB):

ALTER TABLE <tablename> ENGINE=INNODB;

This can be tedious if you have a lot of tables.

• Another option is to use the init_command option for MySQLdb prior to creating your tables:

'OPTIONS' : {

'init_command' : 'SET default_storage_engine=INNODB' ,

}

This sets the default storage engine upon connecting to the database. After your tables have been created, you should remove this option as it adds a query that is only needed during table creation to each database connection.

Table names

There are known issues in even the latest versions of MySQL that can cause the case of a table name to be altered when certain SQL statements are executed under certain conditions. It is recommended that you use lowercase table names, if possible, to avoid any problems that might arise from this behavior. Django uses lowercase table names when it auto-generates table names from models, so this is mainly a consideration if you are overriding the table name via the

db_table

parameter.

Savepoints

Both the Django ORM and MySQL (when using the InnoDB

storage engine ) support database

savepoints .

If you use the MyISAM storage engine please be aware of the fact that you will receive database-generated errors if you try to use the

engine of a MySQL database/table is an expensive operation so it was decided it isn’t worth to dynamically convert these methods in no-op’s based in the results of such detection.

6.7. Databases 969

Django Documentation, Release 2.0.dev20170914110741

Notes on specific fields

Character fields

Any fields that are stored with VARCHAR column types have their max_length restricted to 255 characters if you are using unique=True for the field. This affects

CharField

SlugField

TextField limitations

MySQL can index only the first N chars of a BLOB or TEXT column. Since TextField doesn’t have a defined length, you can’t mark it as unique=True. MySQL will report: “BLOB/TEXT column ‘<db_column>’ used in key specification without a key length”.

Fractional seconds support for Time and DateTime fields

MySQL 5.6.4 and later can store fractional seconds, provided that the column definition includes a fractional indication

(e.g. DATETIME(6)). Earlier versions do not support them at all.

Django will not upgrade existing columns to include fractional seconds if the database server supports it. If you want to enable them on an existing database, it’s up to you to either manually update the column on the target database, by executing a command like:

ALTER TABLE `your_table` MODIFY `your_datetime_column` DATETIME(6) or using a

RunSQL

operation in a

data migration .

TIMESTAMP columns

If you are using a legacy database that contains TIMESTAMP columns, you must set

USE_TZ = False

to avoid data corruption.

inspectdb

maps these columns to

DateTimeField

and if you enable timezone support, both

MySQL and Django will attempt to convert the values from UTC to local time.

Row locking with QuerySet.select_for_update()

MySQL does not support the NOWAIT, SKIP LOCKED, and OF options to the SELECT ... FOR UPDATE statement.

If select_for_update() is used with nowait=True, skip_locked=True, or of then a

NotSupportedError

is raised.

Automatic typecasting can cause unexpected results

When performing a query on a string type, but with an integer value, MySQL will coerce the types of all values in the table to an integer before performing the comparison. If your table contains the values 'abc', 'def' and you query for WHERE mycolumn=0, both rows will match. Similarly, WHERE mycolumn=1 will match the value 'abc1'.

Therefore, string type fields included in Django will always cast the value to a string before using it in a query.

If you implement custom model fields that inherit from

Field

directly, are overriding

use

raw() , you should ensure that you perform appropriate typecasting.

970 Chapter 6. API Reference

Django Documentation, Release 2.0.dev20170914110741

SQLite notes

SQLite provides an excellent development alternative for applications that are predominantly read-only or require a smaller installation footprint. As with all database servers, though, there are some differences that are specific to

SQLite that you should be aware of.

Substring matching and case sensitivity

For all SQLite versions, there is some slightly counter-intuitive behavior when attempting to match some types of strings. These are triggered when using the

iexact

contains

filters in Querysets. The behavior splits into two cases:

For substring matching, all matches are done case-insensitively.

filter(name__contains="aa") will match a name of "Aabb".

That is a filter such as

2. For strings containing characters outside the ASCII range, all exact string matches are performed case-sensitively, even when the case-insensitive options are passed into the query. So the

iexact

filter will behave exactly the same as the

exact

filter in these cases.

Some possible workarounds for this are documented at sqlite.org

, but they aren’t utilized by the default SQLite backend in Django, as incorporating them would be fairly difficult to do robustly. Thus, Django exposes the default SQLite behavior and you should be aware of this when doing case-insensitive or substring filtering.

“Database is locked” errors

SQLite is meant to be a lightweight database, and thus can’t support a high level of concurrency.

OperationalError: database is locked errors indicate that your application is experiencing more concurrency than sqlite can handle in default configuration. This error means that one thread or process has an exclusive lock on the database connection and another thread timed out waiting for the lock the be released.

Python’s SQLite wrapper has a default timeout value that determines how long the second thread is allowed to wait on the lock before it times out and raises the OperationalError: database is locked error.

If you’re getting this error, you can solve it by:

• Switching to another database backend. At a certain point SQLite becomes too “lite” for real-world applications, and these sorts of concurrency errors indicate you’ve reached that point.

• Rewriting your code to reduce concurrency and ensure that database transactions are short-lived.

• Increase the default timeout value by setting the timeout database option:

'OPTIONS' : {

# ...

'timeout' : 20 ,

# ...

}

This will simply make SQLite wait a bit longer before throwing “database is locked” errors; it won’t really do anything to solve them.

QuerySet.select_for_update() not supported

SQLite does not support the SELECT ... FOR UPDATE syntax. Calling it will have no effect.

6.7. Databases 971

Django Documentation, Release 2.0.dev20170914110741

“pyformat” parameter style in raw queries not supported

For most backends, raw queries (Manager.raw() or cursor.execute()) can use the “pyformat” parameter style, where placeholders in the query are given as '%(name)s' and the parameters are passed as a dictionary rather than a list. SQLite does not support this.

Oracle notes

Django supports Oracle Database Server versions 12.1 and higher. Version 5.2 or higher of the cx_Oracle Python driver is required.

In order for the python manage.py migrate command to work, your Oracle database user must have privileges to run the following commands:

• CREATE TABLE

• CREATE SEQUENCE

• CREATE PROCEDURE

• CREATE TRIGGER

To run a project’s test suite, the user usually needs these additional privileges:

• CREATE USER

• ALTER USER

• DROP USER

• CREATE TABLESPACE

• DROP TABLESPACE

• CREATE SESSION WITH ADMIN OPTION

• CREATE TABLE WITH ADMIN OPTION

• CREATE SEQUENCE WITH ADMIN OPTION

• CREATE PROCEDURE WITH ADMIN OPTION

• CREATE TRIGGER WITH ADMIN OPTION

Note that, while the RESOURCE role has the required CREATE TABLE, CREATE SEQUENCE, CREATE PRO-

CEDURE and CREATE TRIGGER privileges, and a user granted RESOURCE WITH ADMIN OPTION can grant

RESOURCE, such a user cannot grant the individual privileges (e.g. CREATE TABLE), and thus RESOURCE WITH

ADMIN OPTION is not usually sufficient for running tests.

Some test suites also create views; to run these, the user also needs the CREATE VIEW WITH ADMIN OPTION privilege. In particular, this is needed for Django’s own test suite.

All of these privileges are included in the DBA role, which is appropriate for use on a private developer’s database.

The Oracle database backend uses the SYS.DBMS_LOB and SYS.DBMS_RANDOM packages, so your user will require execute permissions on it. It’s normally accessible to all users by default, but in case it is not, you’ll need to grant permissions like so:

GRANT EXECUTE ON

SYS.DBMS_LOB TO user;

GRANT EXECUTE ON

SYS.DBMS_RANDOM TO user;

972 Chapter 6. API Reference

Django Documentation, Release 2.0.dev20170914110741

Connecting to the database

To connect using the service name of your Oracle database, your settings.py file should look something like this:

DATABASES = {

'default' : {

'ENGINE' : 'django.db.backends.oracle' ,

'NAME' : 'xe' ,

'USER' : 'a_user' ,

'PASSWORD' : 'a_password' ,

'HOST' : '' ,

'PORT' : '' ,

}

In this case, you should leave both

HOST

and

PORT

empty. However, if you don’t use a tnsnames.ora file or a similar naming method and want to connect using the SID (“xe” in this example), then fill in both

HOST

and

PORT

like so:

DATABASES = {

'default' : {

'ENGINE' : 'django.db.backends.oracle' ,

'NAME' : 'xe' ,

'USER' : 'a_user' ,

'PASSWORD' : 'a_password' ,

'HOST' : 'dbprod01ned.mycompany.com' ,

'PORT' : '1540' ,

}

You should either supply both

HOST

and

PORT

, or leave both as empty strings. Django will use a different connect

descriptor depending on that choice.

Threaded option

If you plan to run Django in a multithreaded environment (e.g. Apache using the default MPM module on any modern operating system), then you must set the threaded option of your Oracle database configuration to True:

'OPTIONS' : {

'threaded' : True,

Failure to do this may result in crashes and other odd behavior.

INSERT ... RETURNING INTO

By default, the Oracle backend uses a RETURNING INTO clause to efficiently retrieve the value of an AutoField when inserting new rows. This behavior may result in a DatabaseError in certain unusual setups, such as when inserting into a remote table, or into a view with an INSTEAD OF trigger. The RETURNING INTO clause can be disabled by setting the use_returning_into option of the database configuration to False:

'OPTIONS' : {

'use_returning_into' : False,

In this case, the Oracle backend will use a separate SELECT query to retrieve AutoField values.

6.7. Databases 973

Django Documentation, Release 2.0.dev20170914110741

Naming issues

Oracle imposes a name length limit of 30 characters. To accommodate this, the backend truncates database identifiers to fit, replacing the final four characters of the truncated name with a repeatable MD5 hash value. Additionally, the backend turns database identifiers to all-uppercase.

To prevent these transformations (this is usually required only when dealing with legacy databases or accessing tables which belong to other users), use a quoted name as the value for db_table:

class LegacyModel

(models.Model):

class Meta

: db_table = '"name_left_in_lowercase"'

class ForeignModel

(models.Model):

class Meta

: db_table = '"OTHER_USER"."NAME_ONLY_SEEMS_OVER_30"'

Quoted names can also be used with Django’s other supported database backends; except for Oracle, however, the quotes have no effect.

When running migrate, an ORA-06552 error may be encountered if certain Oracle keywords are used as the name of a model field or the value of a db_column option. Django quotes all identifiers used in queries to prevent most such problems, but this error can still occur when an Oracle datatype is used as a column name. In particular, take care to avoid using the names date, timestamp, number or float as a field name.

NULL and empty strings

Django generally prefers to use the empty string (‘’) rather than NULL, but Oracle treats both identically. To get around this, the Oracle backend ignores an explicit null option on fields that have the empty string as a possible value and generates DDL as if null=True. When fetching from the database, it is assumed that a NULL value in one of these fields really means the empty string, and the data is silently converted to reflect this assumption.

TextField limitations

The Oracle backend stores TextFields as NCLOB columns. Oracle imposes some limitations on the usage of such

LOB columns in general:

• LOB columns may not be used as primary keys.

• LOB columns may not be used in indexes.

• LOB columns may not be used in a SELECT DISTINCT list.

This means that attempting to use the

QuerySet.distinct

method on a model that includes TextField columns will result in an ORA-00932 error when run against Oracle. As a workaround, use the QuerySet.defer method in conjunction with distinct() to prevent TextField columns from being included in the SELECT DISTINCT list.