Using a params list instead of string formatting on raw query that calls...

... 'crypt' with password and hash

See the warning here about using string formatting on raw queries:

https://docs.djangoproject.com/en/dev/topics/db/sql/#passing-parameters-into-raw