mysql - Prevent SQL injection -


question 1:

i have below mysql query works fine i've discovered not safe approach open sql injection. can see clause issue if wanted pass argument.

_, err := dbmap.select(&response.appsdata, "select...", ?)

any advice appriciated.

where := ""  := 0; < (len(acl_user_apps)); i++ {     fmt.println(acl_user_apps[i].appid)     fmt.println(acl_user_apps[i].permissions)      if == "" {         = "where apps.id=" + strconv.itoa(acl_user_apps[i].appid)     } else {         = + " or apps.id=" + strconv.itoa(acl_user_apps[i].appid)     } }  query := "select apps.*, group_concat(distinct ifnull(appcategorymatches.category_id,'-1') separator ',') temp,   group_concat(distinct ifnull(appcategories.category_name,'-1') separator ',') tmp_name apps left join appcategorymatches on appcategorymatches.app_id=apps.id left join appcategories on (appcategorymatches.`category_id` = appcategories.id) " + + " group apps.id order " + sort_by + " " + order_by + " limit " + limit + " offset " + offset) _, err := dbmap.select(&response.appsdata,query)

question 2: wondering if has ever had issues passing order argument...

_, err := dbmap.select(&response.appsdata,         "select apps.*, group_concat(distinct ifnull(appcategorymatches.category_id,'-1') separator ',') temp, group_concat(distinct ifnull(appcategories.category_name,'-1') separator ',') tmp_name apps left join appcategorymatches on appcategorymatches.app_id=apps.id left join appcategories on (appcategorymatches.category_id = appcategories.id) group apps.id order ?", "title")

this order simplest thing ever... why isnt working?

you absolutely don't want "escaping" strings on own, nor concatenating strings make queries.

  1. go's database/sql (http://golang.org/pkg/database/sql/) package supports parameterised queries default - e.g. db.query("select * users id=? , active=?", id, userstatus) - ? acts placeholder mysql handle variables.

  2. you can (in combination parameterised queries) use query builder mgutz/dat can if you're not great @ writing raw sql. package or sqlx helps pack/unpack queries to/from structs or maps in application.

there's great guide in tutorial using go's database package. highly suggest reading it.


Comments

Post a Comment

Popular posts from this blog

javascript - Google App Script ContentService downloadAsFile not working -

i have web app developed using google app script htmlservice , html form, populating excel sheet in google drive using spreadsheetapp . , 1 section calling contentservice download data excel file. function doget(e) { // read excel sheet //getappfile(); // render application html template return htmlservice.createtemplatefromfile('index').evaluate() .settitle('go smart') .setsandboxmode(htmlservice.sandboxmode.iframe); } function downloaddoublequatecsvfile() { var sheetid = propertiesservice.getscriptproperties().getproperty('sheetid'); var ss = spreadsheetapp.openbyid(sheetid).getactivesheet(); //var ss = spreadsheetapp.getactivespreadsheet().getactivesheet(); var maxcolumn = ss.getlastcolumn(); var maxrow = ss.getlastrow(); var data = ss.getrange(1, 1, maxrow, maxcolumn).getvalues(); if (data.length > 1) { var csv = ""; (var row = 0; row < data.length; row++) { (var c...
Read more

javascript - Function overwritting -

is there way overwrite function or event handling in function? using addeventlistener, can have many event handlers on element want var test=document.getelementbyid("div"); test.addeventlistener("click",function(){alert("im first");},false); test.addeventlistener("click",function(){alert("im second");},false); // alerts "im first" , after "im second" but if want overwrite function/event example based on client width example this function one() { alert("first"); } function two() { alert("second"); } window.onresize = function() { var test = document.getelementbyid("div"); if (window.innerwidth > 500) { test.onclick = 1 } else { test.onclick = two; } } is possible in javascript? in case use effective little known approach. addeventlistener can accept object property handleevent event handler. in case it's easy overwr...
Read more

php - Find a regex to take part of Email -

i have following emails need extract part from: bestellnummer xxx: 1 von xxx, 1er pack ------------- anfang der nachricht ------------- foo bar baz foo bar baz // <<<<< need text here ------------- ende der nachricht ------------- ------------- anfang der nachricht ------------- foo bar baz foo bar baz ------------- ende der nachricht ------------- there 0 unlimited occurences of ------------- anfang der nachricht ------------- ------------- ende der nachricht ------------- and i'm able extract first part regex: $re = "/------------- .*? -------------.?(.*?).?------------- .*? -------------/s"; but, i'm quite new on learning regex, i'm pretty sure there must better regex extract part (foo bar baz foo bar baz) of text between ------------- anfang der nachricht ------------- ------------- ende der nachricht ------------- as can in different languages, i'm using .? to match between hyphens. i...
Read more