search

gobuffalo / pop

A Tasty Treat For All Your Database Needs
MIT License
1.44k stars 241 forks source link

escape sql in sqlbuilder buildOrderClauses #116

Open u007 opened 6 years ago

u007 commented 6 years ago

hi, i realize its potentially harmful if we do not escape potential sql injection in here

mind if i add it in?

sio4 commented 2 years ago

Not like WHERE, ORDER will not take an argument supplied by external users so the possibility of injection is very low. However, checking them for SQL injection could be an important task.