Detected string concatenation with a non-literal variable in a "database/sql" Go SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, used parameterized queries or prepared statements instead. You can use prepared statements with the 'Prepare' and 'PrepareContext' calls.

[get-famed[bot]]

🦸‍♀️ Famed Scanner

📝 Description

Detected string concatenation with a non-literal variable in a "database/sql" Go SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, used parameterized queries or prepared statements instead. You can use prepared statements with the 'Prepare' and 'PrepareContext' calls.

📁 Related files

sql-inject.go

This issue was created by famed 🤖

[get-famed[bot]]

🤖 Assignees for issue Detected string concatenation with a non-literal variable in a "database/sql" Go SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, used parameterized queries or prepared statements instead. You can use prepared statements with the 'Prepare' and 'PrepareContext' calls. #24 are now eligible to Get Famed.

❌ Add assignees to track contribution times of the issue 🦸‍♀️🦹️ ❌ Add a single severity (CVSS) label to compute the score 🏷️️

Happy hacking! 🦾💙❤️️