Fix SQL Injection (Legacy & Modern) in Iris

Iris is marketed as the fastest web framework for Go, but speed is irrelevant if your database is leaked via a trivial UNION-based injection. In legacy Iris apps, developers often bypassed the type-safety of Go to build dynamic queries using string concatenation. Modern Iris development usually involves ORMs like GORM or XORM, but even then, misuse of 'Raw' methods or improper input handling creates critical vulnerabilities. To fix this, you must enforce strict parameterization and use the database driver's native binding capabilities.

The Vulnerable Pattern

func GetUserHandler(ctx iris.Context) {
	userID := ctx.Params().Get("id")
	// VULNERABLE: Direct string interpolation allows an attacker to inject SQL commands
	query := fmt.Sprintf("SELECT username, email FROM users WHERE id = %s", userID)
	rows, err := db.Query(query)
	if err != nil {
		ctx.StopWithStatus(iris.StatusInternalServerError)
		return
	}
	// ... process rows
}

The Secure Implementation

The fix relies on Prepared Statements and Parameterized Queries. When you use '?', the database driver sends the query template and the data separately. The SQL engine never parses the user input as code, rendering injection impossible. In modern Iris apps using GORM, avoid 'db.Raw()' with formatted strings; instead, use 'db.Where("id = ?", userID).First(&user)'. Additionally, leverage Iris's built-in parameter macros (e.g., /user/{id:uint64}) to ensure the input matches the expected data type before it even reaches your controller logic.

func GetUserHandler(ctx iris.Context) {
	// Use ReadUint64 or similar to enforce type safety at the routing level
	userID, err := ctx.Params().GetUint64("id")
	if err != nil {
		ctx.StopWithStatus(iris.StatusBadRequest)
		return
	}
// SECURE: Use parameterized queries. The '?' is a placeholder handled by the driver.
rows, err := db.Query("SELECT username, email FROM users WHERE id = ?", userID)
if err != nil {
	ctx.StopWithStatus(iris.StatusInternalServerError)
	return
}
defer rows.Close()
// ... process rows
}