We read every piece of feedback, and take your input very seriously.
To see all available qualifiers, see our documentation.
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Example shows
sql := sqlstring.Format("select * from users where name=? and age=? limit ?,?", "t'est", 10, 10, 10) fmt.Printf("sql: %s\n", sql)
Outputting
sql: select * from users where name='t\'est' and age=10 limit 10,10
Which is correct. However, this protection can easily be defeated:
sql := sqlstring.Format("select * from users where name=? and age=? limit ?,?", `t\'est`, 10, 10, 10) fmt.Printf("sql: %s\n", sql)
sql: select * from users where name='t\\'est' and age=10 limit 10,10
The double backslash fails to escape the single quote resulting in SQL injection vulnerability.
https://go.dev/play/p/qVnax1F8P9M
The text was updated successfully, but these errors were encountered:
Thanks for the report @kevburnsjr
Sorry, something went wrong.
fixed SQL Injection for #2
f916c53
It has been fixed.
No branches or pull requests
Example shows
Outputting
Which is correct. However, this protection can easily be defeated:
Outputting
The double backslash fails to escape the single quote resulting in SQL injection vulnerability.
https://go.dev/play/p/qVnax1F8P9M
The text was updated successfully, but these errors were encountered: