flawopen.com/sql-injection/Go

इस पेज के मुख्य शब्द

Web Application Security

सुरक्षा अवधारणा (Web Application Security): Core architecture component affected by CWE-89.

CWE-89

सुरक्षा अवधारणा (CWE-89): Standard Common Weakness Enumeration classification for sql-injection-go.

Defense-in-Depth

सुरक्षा अवधारणा (Defense-in-Depth): Multi-layered engineering verification and runtime boundary isolation.

हमले का चरण-दर-चरण प्रवाह

सोर्स कोड: कमज़ोर बनाम सुरक्षित कार्यान्वयन

// userID comes straight from the request
query := fmt.Sprintf(
  "SELECT * FROM users WHERE id = %s",
  userID,
)
rows, err := db.Query(query)

// value passed as a query argument
rows, err := db.Query(
  "SELECT * FROM users WHERE id = $1",
  userID,
)

इंजीनियरिंग और सिस्टम सुरक्षा चेकलिस्ट

• ✓अनुशंसित सुरक्षा नियम: Pass values as separate arguments to Query/Exec — never build the query with Sprintf।
• ✓अनुशंसित सुरक्षा नियम: Match placeholder syntax to your driver (? vs $1)।
• ✓अनुशंसित सुरक्षा नियम: If using an ORM's raw-query method, still pass placeholders and args separately।
• ✓gosec in CI to catch regressions automatically चलाएं।

References

• CWE-89: Improper Neutralization of Special Elements used in an SQL Command
• Go standard library — database/sql, Query
• gosec — Go security checker
• OWASP SQL इंजेक्शन रोकथाम चीट शीट