Building RESTful Web services with Go

SQL injections in URLs and ways to avoid them

SQL injection is the process of attacking a database with malicious scripts. If we are not careful while writing secure URL routes, there may be an opportunity for SQL injection. These attacks usually happen for the POST, PUT, and DELETE HTTP verbs. For example, if we are allowing the client to pass variables to the server, then there is a chance for an attacker to append a string to those variables. If we are inserting those users sending parameters directly into an SQL query, then it could be injectable. The right way to talk to DB is to allow driver functions to check the parameters before inserting the string and executing it in the database:

username := r.Form.Get("id")password := r.Form.Get("category") ...