Zennoxa Shield
Rules / Go
SHIELD-GO-002

SQL Injection via string concatenation

criticalGoCWE-89CVSS 9.8

What it detects

Building SQL with + concatenation allows injection.

How to fix

Use parameterized queries. Never concatenate user input into SQL strings.

Vulnerable — Shield flags thisorder_search.go
package store

import "database/sql"

func FindOrders(db *sql.DB, status string) (*sql.Rows, error) {
	// status is concatenated straight into the SQL string — injectable
	return db.Query("SELECT id, total FROM orders WHERE status = '" + status + "'")
}
Fixed — scans cleanorder_search.go
package store

import "database/sql"

func FindOrders(db *sql.DB, status string) (*sql.Rows, error) {
	// Parameterized query: no user input in the SQL string itself.
	return db.Query("SELECT id, total FROM orders WHERE status = ?", status)
}

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-GO-002, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-GO-002: SQL Injection via string concatenation — Zennoxa Shield