mirror of
https://github.com/github/codeql.git
synced 2026-08-04 09:23:23 +02:00
14 lines
304 B
Go
14 lines
304 B
Go
package main
|
|
|
|
import (
|
|
"database/sql"
|
|
"fmt"
|
|
"net/http"
|
|
)
|
|
|
|
func handler(db *sql.DB, req *http.Request) {
|
|
q := fmt.Sprintf("SELECT ITEM,PRICE FROM PRODUCT WHERE ITEM_CATEGORY='%s' ORDER BY PRICE",
|
|
req.URL.Query()["category"]) // $ Source[go/sql-injection]
|
|
db.Query(q) // $ Alert[go/sql-injection]
|
|
}
|