frappe-core-database

Prevent SQL injection in Frappe by using parameterized SQL with frappe.db.sql and passing variables as a parameter list. For complex queries needing joins or aggregations, prefer the frappe.qb Query Builder to avoid unsafe string interpolation.

frappe.db.get_list enforces permission-aware listing for database operations, ensuring users only see records they can access. In contrast, frappe.get_all bypasses permission checks, making get_list the correct choice for secure Frappe CRUD workflows.

Avoid N+1 queries in the Frappe ORM by using frappe.db.get_list or frappe.qb to fetch related records in batched queries. Apply pagination, use specific field selection instead of SELECT *, and leverage frappe.get_cached_doc for repeated single-record reads.

Yes, the Frappe Query Builder supports joins and aggregations across v14 to v16. Using frappe.qb for complex query logic is the recommended pattern to safely build structured queries without writing raw SQL.

You must use the tab prefix for table names in Frappe raw SQL queries because the framework prefixes all DocType tables with 'tab' in the database. Omitting it causes query failures since the database cannot find the correct table name.

Use frappe.get_cached_doc instead of frappe.get_doc when you need to read the same document multiple times within a request, as it retrieves the document from Redis cache. This avoids repeated database queries and significantly improves application performance.