Comment by oefrha

Looks more like a contrived example to me:

  h.db.Exec(fmt.Sprintf("insert into users(name, email, phone_number) values ('%s', '%s', '%s');",
       request.Name, request.Email, request.PhoneNumber))

Any database driver including database/sql will support

  h.db.Exec("insert into users(name, email, phone_number) values (?, ?, ?);",
       request.Name, request.Email, request.PhoneNumber)

which is shorter and more natural. They’re throwing in a fmt.Sprintf in there for no reason other than forcing a tired old SQL injection.

Now, shitty HTML templating causing injection with unsanitized user input is a lot more realistic, since the golang templating story isn’t great.

Edit: “templating” -> “HTML templating”.