SQL Injection (ARCH5100)

Key go.security.sql-injection · Severity error · Category security · CWE CWE-89

Embedding user input into a SQL query via concatenation or fmt.Sprintf lets attackers alter the query structure to read or destroy data.

Incorrect

func getUser(db *sql.DB, name string) (*sql.Row, error) {
  q := fmt.Sprintf("SELECT id, email FROM users WHERE name = '%s'", name)
  return db.QueryRow(q), nil
}

Correct

func getUser(db *sql.DB, name string) (*sql.Row, error) {
  return db.QueryRow("SELECT id, email FROM users WHERE name = ?", name), nil
}

Fix

Never concatenate input into queries; use parameterized queries (placeholders) for all user input.