sqlmap automates the whole SQL injection workflow: detecting the injectable parameter, fingerprinting the DBMS, and then escalating from a boolean oracle to full data extraction.
It matters for a Django project because it answers the question a code review cannot: is this parameter actually exploitable? Django's ORM parameterises queries, so sqlmap finds nothing against normal code — point it at a view using .raw() or .extra() with string formatting and it dumps the table.
Techniques worth knowing by name: boolean-based blind, time-based blind, error-based, UNION query, and stacked queries.