Zennoxa Shield
Rules / Go
SHIELD-GO-001

SQL Injection via string formatting

criticalGoCWE-89CVSS 9.8

What it detects

SQL query built with fmt.Sprintf or string concatenation may allow SQL injection.

How to fix

Use parameterized queries with ? or $N placeholders instead of fmt.Sprintf.

Vulnerable — Shield flags thisuser_store.go
package store

import (
	"database/sql"
	"fmt"
)

func GetUserByName(db *sql.DB, username string) *sql.Row {
	// username comes straight from the request — injectable
	return db.QueryRow(fmt.Sprintf("SELECT id, email FROM users WHERE username = '%s'", username))
}
Fixed — scans cleanuser_store.go
package store

import (
	"database/sql"
)

func GetUserByName(db *sql.DB, username string) *sql.Row {
	// Parameterized query: the driver escapes username safely.
	return db.QueryRow("SELECT id, email FROM users WHERE username = ?", username)
}

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-GO-001, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-GO-001: SQL Injection via string formatting — Zennoxa Shield