Is GORM's Raw() method safe from SQL injection?

Reference page — draft, pending review

Short answer

Only when you pass placeholders and args separately. It executes exactly the query text you give it, with no awareness of where that text came from.

UNSAFE

db.Raw(fmt.Sprintf(
  "SELECT * FROM users WHERE id = %s",
  userID,
)).Scan(&user)

SAFE

db.Raw(
  "SELECT * FROM users WHERE id = ?",
  userID,
).Scan(&user)

The rule

GORM's chainable query builder (db.Where(...).First(&user)) parameterizes automatically and needs no special care. Raw() is a deliberate escape hatch for queries the builder can't express — it stays safe only if you never build the query string yourself with fmt.Sprintf first.

How to check your codebase

grep -rn "\.Raw(fmt.Sprintf" --include="*.go" .

FAQ

Is the standard chainable query builder always safe?

Yes — Where(), First(), and similar methods parameterize automatically regardless of the value's content.

References

GORM docs — SQL Injection Methods
flawopen.com — SQL Injection in Go