GORM uses the
database/sql‘s argument placeholders to construct the SQL statement, which will automatically escape arguments to avoid SQL injection
NOTE The SQL from Logger is not fully escaped like the one executed, be careful when copying and executing it in SQL console
User’s input should be only used as an argument, for example:
userInput := "jinzhu;drop table users;"
// will be escaped
When retrieving objects with number primary key by user’s input, you should check the type of variable.
userInputID := "1=1;drop table users;"
To support some features, some inputs are not escaped, be careful when using user’s input with those methods
db.Select("name; drop table users;").First(&user)
The general rule to avoid SQL injection is don’t trust user-submitted data, you can perform whitelist validation to test user input against an existing set of known, approved, and defined input, and when using user’s input, only use them as an argument.