Example of failed SQL Language type injection for GoLand

main.go

package main

import "database/sql"

type executor struct {
	db *sql.DB
}

func (e executor) exec(query string) {
	e.db.Exec(query)
}

func main() {
	e := executor{}
	testDirect(nil)
  testExecutor(e)
}

func testDirect(db *sql.DB) {
	// this DOES inject SQL as the language for the fragment below
	const exampleQuery = `
		SELECT user_id,
			   first_name,
			   last_name
		FROM users
		WHERE user_id = :user_id;
	`
	db.Exec(exampleQuery)
}

func testExecutor(e executor) {
	// this DOES NOT inject SQL as the language for the fragment below
	const exampleQuery = `
		SELECT user_id,
			   first_name,
			   last_name
		FROM users
		WHERE user_id = :user_id;
	`
	e.exec(exampleQuery)
}