go语言中mysql中防注入,在使用“数据库/ SQL”时如何在Go中防止SQL注入攻击？

How much protection against SQL injection do I get from just always using the 'database/sql' library and constructing queries using '?' instead of concatting strings? What kind of SQL injection attacks will I still have to worry about in that case?

解决方案

As long as you're using Prepare or Query, you're safe.

// this is safe

db.Query("SELECT name FROM users WHERE age=?", req.FormValue("age"))

// this allows sql injection.

db.Query("SELECT name FROM users WHERE age=" + req.FormValue("age"))