safe_column_query.go

safe_column_query.go

func query(db *sql.DB, orderBy []string) {
  query := fmt.Sprint("select id, name, grade from students ")
  paging := ""
  if len(opt.OrderBy) > 0 {
    validColumn := map[string]string{
        "id":         "id",
        "created_at": "created_at",
    }
    paging = sanitizeOrderBy(orderBy, validColumn, paging)
  }
  
  query = query + paging
  _, err := db.Query(query)
  if err != nil {
    fmt.Println(err.Error())
    return
  }
}

func sanitizeOrderBy(cols []string, valid map[string]string, defaultString string) (res string) {
    sort := map[string]string{
        "asc":  "asc",
        "desc": "desc",
    }
    i := 0
    for _, col := range cols {
        ss := strings.Split(col, " ")

        if v, ok := valid[ss[0]]; ok {
            if i != 0 {
                res += ", "
            }
            res += prefix + v + " "
            if len(ss) > 1 {
                if v, ok := sort[strings.ToLower(ss[1])]; ok {
                    res += v + " "
                }
            }
            i++
        }
    }

    if res != "" {
        res = "order by " + res
    } else {
        res = defaultString
    }
    return
}