Files
codeql/go/ql/test/query-tests/Security/CWE-089/SqlInjection.go
2022-05-20 10:07:19 -07:00

14 lines
245 B
Go

package main
import (
"database/sql"
"fmt"
"net/http"
)
func handler(db *sql.DB, req *http.Request) {
q := fmt.Sprintf("SELECT ITEM,PRICE FROM PRODUCT WHERE ITEM_CATEGORY='%s' ORDER BY PRICE",
req.URL.Query()["category"])
db.Query(q)
}