Raw Sql Injection Risk (ARCH5055)
Esta página aún no está disponible en tu idioma.
Key go.orm.raw-sql-injection-risk · Severity critical · Category orm
Building raw SQL via string interpolation or concatenation is both a SQL injection vector and a query-plan-cache buster. Always use bound parameters.
Incorrect
Section titled “Incorrect”db.Raw("SELECT * FROM users WHERE email = '" + email + "'").Scan(&u)Correct
Section titled “Correct”db.Raw("SELECT * FROM users WHERE email = ?", email).Scan(&u)Never concatenate user input into raw SQL; pass bound parameters with ? placeholders.