henriquebastos/django-aggregate-if — pull request #3 by iurisilvio (2013-01-07 12:21:47+00:00)
Title: Avoid SQL injection

I didn't try harder to found a useful example to inject, but I'm sure it is possible to exploit it with a crafted parameter, so you should always escape single quotes.