Django Subquery doesn't escape dates - django

Question

I have a query that filters registers according to some dates, and uses subqueries to aggregate data. It goes like this:
# Parse datetime
st_date = timezone.datetime.strptime(...)
ed_date = timezone.datetime.strptime(...)
# Main queryset
clients = Client.objects.all()
# Subquery
details = Detail.objects.filter(
temp__client__id=OuterRef('pk'),
temp__datetime__date__range=(st_date, ed_date))
# Filter brand
brand_values = detalles.filter(
product__brand__id=...).values(
'temp__client')
# Aggregate
total_qtys = brand_values.annotate(t=Sum('qty')).values('t')
# Annotate to main query
qs = clients.annotate(brand_1:
Subquery(total_qtys, output_field=FloatField()))
And it works on my local env, but on production it always returns null for all rows. Upon inspection I noticed that the generated query goes like:
SELECT ...,
COALESCE((SELECT SUM(U0.`qty`) AS `t`
FROM `sales_detail` U0
INNER JOIN `sales_temp` U1
ON (U0.`temp_id` = U1.`id`)
INNER JOIN `inventory_product` U3
ON (U0.`product_id` = U3.`id`)
WHERE (U1.`cliente_id` = (`sales_client`.`id`) AND DATE(
CONVERT_TZ(U1.`datetime`, 'UTC',
'America/Mexico_City')) BETWEEN 2018-12-01 AND 2018-12-31 AND
U3.`brand_id` = 6)
GROUP BY U1.`client_id`
ORDER BY NULL), 0) AS `brand_1`
FROM `sales_client`
WHERE NOT (`sales_client`.`status_rip` = True)
And if I run the raw query against my local db it fails, too. I then noticed that the dates are being unquoted, and the problem is solved by just quoting them, i.e. by replacing 2018-12-01 for '2018-12-01' in the raw query.
So the question is: why doesn't Django quote the dates? and more important: Why does it work only when executed by the ORM?
Edit:
This is the configuration on both local and production
Local:
Fedora 28
Mariadb 10.1.25 running on Docker with the following config:
#mariadb.cnf
[client]
default-character-set = utf8
[mysqld]
character-set-server = utf8
collation-server = utf8_general_ci
character_set_server = utf8
collation_server = utf8_general_ci
!includedir /etc/mysql/mariadb.conf.d/
Production:
Fedora 24
Mariadb installed from repos, version 10.1.25, with no config. changes

Answer 1

You may not like these answers. QuerySet.query is not specific to the database yet. It is the generic version of the query as it may apply to any database. So in that case, you will have to add the quotations to the dates, datetimes and maybe a few other data types. I can't remember which. The cursor is what handles the actual escaping of parameters.
From Django's code:
def _execute_query(self):
connection = connections[self.using]
# Adapt parameters to the database, as much as possible considering
# that the target type isn't known. See #17755.
params_type = self.params_type
adapter = connection.ops.adapt_unknown_value
if params_type is tuple:
params = tuple(adapter(val) for val in self.params)
elif params_type is dict:
params = {key: adapter(val) for key, val in self.params.items()}
else:
raise RuntimeError("Unexpected params type: %s" % params_type)
self.cursor = connection.cursor()
self.cursor.execute(self.sql, params)
As you can see, the QuerySet nor the Query actually escapes the parameters. It passes them to the database wrapper / cursor to handle as each database may need to do it differently.
In regards to why Production has different results than locally, I would check your data. The code should be generating the same query for the database which means it's most likely the data is causing the different results.