Oct. 11, 2018
5:27 p.m.
On the server side, the application could be doing something like assuming that the kwargs are e.g. column names
This is exactly a use-case for non-identifier strings in kwargs. The rules for valid field names could very well be different than Python’s rules. The kwargs implementation is not the place for sanitizing to take place — each app will need different sanitization rules. -CHB