The author demonstrates an SQL "injection" via "malicious" django-admin.py input. Is it really SQL injection if the user has access to your site's admin script?

Some input really is trusted.