Fix SQL Injection (Legacy & Modern) in Gorilla

Gorilla Mux handles your routing, but it won't save your database from a blind injection if you're concatenating strings. In the Go ecosystem, SQLi occurs when developers bypass the 'database/sql' parameterization engine. Whether you are maintaining a legacy monolith or a modern microservice, failing to use placeholders is a critical vulnerability that leads to full data exfiltration or RCE via UDFs.

The Vulnerable Pattern

func GetUserHandler(w http.ResponseWriter, r *http.Request) {
	vars := mux.Vars(r)
	userID := vars["id"]
	// CRITICAL VULNERABILITY: String concatenation allows SQL injection
	query := "SELECT username, email FROM users WHERE id = '" + userID + "'"
	rows, err := db.Query(query)
	if err != nil {
		http.Error(w, "Internal Error", 500)
		return
	}
	defer rows.Close()
	// ... process rows
}

The Secure Implementation

The vulnerable code uses raw string concatenation, allowing an attacker to pass '1 OR 1=1' to bypass authentication or '1; DROP TABLE users' to destroy data. The secure implementation utilizes the 'database/sql' driver's ability to handle placeholders. By passing 'userID' as a separate argument to 'db.Query', the SQL driver treats the input strictly as data, not executable code. For modern Go development, leverage 'sqlx' for cleaner scans or an ORM like 'GORM', but always verify that the underlying query generation uses prepared statements under the hood.

func GetUserHandler(w http.ResponseWriter, r *http.Request) {
	vars := mux.Vars(r)
	userID := vars["id"]
	// SECURE: Using parameterized queries with placeholders
	// Use '?' for MySQL/SQLite or '$1' for PostgreSQL
	query := "SELECT username, email FROM users WHERE id = ?"
	rows, err := db.Query(query, userID)
	if err != nil {
		http.Error(w, "Internal Error", 500)
		return
	}
	defer rows.Close()
	// ... process rows
}