This repository was archived by the owner on Feb 27, 2026. It is now read-only.
Add documentation for rule G201#12
Merged
gcmurphy merged 2 commits intosecurego:masterfrom Feb 19, 2019
Merged
Conversation
gcmurphy
suggested changes
Feb 15, 2019
Member
gcmurphy
left a comment
gcmurphy
left a comment
There was a problem hiding this comment.
Found a couple of typos and grammar type problems that you should fix. The other suggestion I have is a static query in not the only safe thing we can recommend people use. If you use the DB interface correctly you can avoid most SQL injection vectors.
| title: G201: SQL query construction using format stringg | ||
| --- | ||
|
|
||
| SQL injection is one of the top security issues develops made and the consequences of this can be enormous. |
Member
There was a problem hiding this comment.
I would change 'develops made' to 'developers make', and maybe 'enormous' to 'severe'.
Collaborator
Author
There was a problem hiding this comment.
I agree and I will change it.
| @@ -0,0 +1,67 @@ | |||
| --- | |||
| id: g201 | |||
| title: G201: SQL query construction using format stringg | |||
| ## The right way | ||
|
|
||
| Using a static SQL query is always preferred. | ||
|
|
Member
There was a problem hiding this comment.
It can also be safe to use a prepared SQL query, or using parametrised queries like db.Query("SELECT * FROM foo WHERE name = ?", name) in addition to static queries.
added 2 commits
February 18, 2019 10:51
Introduction + incorrect example + correct example + reference links. Signed-off-by: Martin Vrachev <mvrachev@vmware.com>
I fixed a few typos and added a paragraph about the use of database/sql package. Signed-off-by: Martin Vrachev <mvrachev@vmware.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Introduction + incorrect example + correct example + reference links.
Signed-off-by: Martin Vrachev mvrachev@vmware.com