'This tests that SQL injection isn\'t possible using compilation of
expressions in iterable filters, as their compilation happens before
the main query compilation. It\'s limited to SQLite, as PostgreSQL,
Oracle and other vendors have defense in depth against this by type
checking. Testing against SQLite (the most permissive of the built-in
databases) demonstrates that the problem doesn\'t exist while keeping
the test simple.'

@unittest.skipUnless((connection.vendor == 'sqlite'), "This    defensive    test    only    works    on    databases    that    don't    validate    parameter    types")
def test_complex_expressions_do_not_introduce_sql_injection_via_untrusted_string_inclusion(self):

    queryset = Company.objects.filter(name__in=[(F('num_chairs') + '1))    OR    ((1==1')])
    self.assertQuerysetEqual(queryset, [], ordered=False)
