4 ms·
"SQL Injection (Go's database integration is still the wild west)" Is something like this prone to SQL injection ? I am very new to Go and still learning how t
by codegeek 7y ago
"SQL Injection (Go's database integration is still the wild west)"
Is something like this prone to SQL injection ? I am very new to Go and still learning how to interact with databases (I am not a big fan of ORMs).
stmt = "UPDATE users SET last_login = $1 WHERE id = $2"
_, err = services.DB.ExecContext(ctx, stmt, time.Now(), id)
- pstuart 7y agoThat is the correct approach.
- rhinoceraptor 7y agoThat would only be vulnerable if the DB client is replacing your parameterized query with string concatenation under the hood.