Golang文本/模板中的SQL查询

<code class="go">package main

import (
    "os"
    "text/template"
)

const querytemplate = `select * from users where username = '{{.username}}';`

func main() {
    tmpl, err := template.New("sql").Parse(querytemplate)
    if err != nil {
        panic(err)
    }

    data := map[string]string{
        "username": "admin' or '1'='1", // 恶意输入
    }

    tmpl.Execute(os.Stdout, data)
}</code>

<code class="sql">select * from users where username = 'admin' or '1'='1';</code>

<code class="bash">go get github.com/rabbit-backend/template</code>

<code class="go">package main

import (
    "fmt"

    engine "github.com/rabbit-backend/template"
)

func main() {
    query, args := engine.execute(
        "test/app.sql",
        map[string]map[string]string{
            "args": {"user": "admin' or '1'='1"},
        },
    )

    fmt.Println(query, args)
}</code>

<code class="sql">select * from users where username = {{.args.user}};</code>

<code>SELECT * FROM users WHERE username = $1  ["admin' OR '1'='1'"]</code>