?? Golang ?????? ?? ??: SQL ?? ??

???? ?? ????? ?? ?? ??? ???? ?????. ? ????? ??????? ?? ??? ? ?? ???? ??? SQL ?? ??????? Golang ??????? ???? ? ??? ???. ?? SQL ? ORM(?? ??? ??) ?????? ?? ???? ?? ??? ???????.

SQL ??? ??

SQL ??(SQLi)? ??? ? ?? ?????. ???? ?????? ??? ?? SQL ??? ???? ?? ???? ????? ??? ???? ?????? ??? ??????.

??? ?? ?:

query := "SELECT * FROM users WHERE username='" + username + "' AND password='" + password + "'"
rows, err := db.Query(query)

username ?? password? ???? ??? ??? ?? ??? ??? ? ????.

SQL ???? ?? ? ?? ??? ?? ???? ?????.

?? SQL ?? ??

SQL? ?? ??? ?? ?? ?? ??? ??????.

1. ??? ???: Go? database/sql ???? SQLi? ?? ??? ?? ??? ??? ???? ?????.

??? ?:

query := "SELECT * FROM users WHERE username='" + username + "' AND password='" + password + "'"
rows, err := db.Query(query) // Vulnerable to SQL injection

?? ??(??? ??):

query := "SELECT * FROM users WHERE username = ? AND password = ?"
rows, err := db.Query(query, username, password)
if err != nil {
    log.Fatal(err)
}

??? ???? ??? ??? ???? ??????? ??? ?????.

2. ?????? ??: ?????? ???? ?? ???? ?? db.Query ?? db.Exec? ?????.

query := "INSERT INTO products (name, price) VALUES (?, ?)"
_, err := db.Exec(query, productName, productPrice)
if err != nil {
    log.Fatal(err)
}

?? ??? ?? ??? ???? fmt.Sprintf? ????.

3. QueryRow ?? ???? ??: ?? ? ??? ?? QueryRow ??? ??????.

query := "SELECT id, name FROM users WHERE email = ?"
var id int
var name string
err := db.QueryRow(query, email).Scan(&id, &name)
if err != nil {
    log.Fatal(err)
}

4. ?? ?? ? ??: ??? ?? ??? ?? ?? ? ??:

• ??: ??? ?? ??? ?????.
• ??: ?? ??, ?? ? ??? ?????.

Go ?? ?? ?:

func isValidUsername(username string) bool {
    re := regexp.MustCompile(`^[a-zA-Z0-9_]+$`)
    return re.MatchString(username)
}

if len(username) > 50 || !isValidUsername(username) {
    log.Fatal("Invalid input")
}

5. ?? ????: ?????? ?? ???? ?? ?? ?? ???:

CREATE PROCEDURE AuthenticateUser(IN username VARCHAR(50), IN password VARCHAR(50))
BEGIN
    SELECT * FROM users WHERE username = username AND password = password;
END;

Go?? ??:

_, err := db.Exec("CALL AuthenticateUser(?, ?)", username, password)
if err != nil {
    log.Fatal(err)
}

ORM? ?? SQL ?? ??

GORM ? XORM? ?? ORM? ?????? ?? ??? ?????? ??? ??? ??? ???????.

1. ??:

??? ?(?? ??):

db.Raw("SELECT * FROM users WHERE name = '" + userName + "'").Scan(&user)

?? ?(?????? ??):

db.Raw("SELECT * FROM users WHERE name = ? AND email = ?", userName, email).Scan(&user)

GORM? Raw ???? ?? ???? ?????. Where:

query := "SELECT * FROM users WHERE username='" + username + "' AND password='" + password + "'"
rows, err := db.Query(query)

2. ??? ???? ?? SQL? ????. ??? ?? ???? ?? ???? ?????.

3. ??? ??? ?? ??? ??: ??? ORM ??? ?? ??? ?? ??:

query := "SELECT * FROM users WHERE username='" + username + "' AND password='" + password + "'"
rows, err := db.Query(query) // Vulnerable to SQL injection

??? ? ???? ??:

1. ???? ??? ??? ????.
2. ?? ??? ???? ORM ??? ????.
3. ?? ??? ??? ??? ?? ???? ???.

??

Golang? ??? ?????? ????? ?? ??? ??? ?????. ??? ???, ?????? ??, ORM? ???? ???? ??? ??? ???? ?? ? ???? SQL ?? ???? ??? ?? ?? ? ????.

?? ?????:

• ????
• ???
• ???/X

? ??? Golang?? ?? SQL ? ORM? ??? SQL ?? ??? ?? ?????. ??? ??? PHP ??? ????? ?? ?? ??? ?????!