Are query strings in golang safe?

Question

Consider the following fetch of the URLParam userId passed on a URL:

userId := http.Request.URL.Query().Get("userId")

Is this safe (escaped and ready to be used in a db call) as it is or do I need to escape it /sanitize it before use?

Nothing should ever be assumed "safely escaped" - always use your database driver's parameterisation. — elithrar
– elithrar, Commented Aug 22, 2014 at 15:04
Thanks. Redis hasn't got such a method afaik but thanks anyways. — Adergaard
– Adergaard, Commented Aug 22, 2014 at 15:13
You didn't mention Redis—which isn't vulnerable because it's a key:value store. Values aren't inspected/processed, and commands are separate from data (unlike SQL). — elithrar
– elithrar, Commented Aug 22, 2014 at 15:21
Redis was an example of a "database" that has no such method. The fact that values aren't inspected there is irrelevant. The use of that value may later be in such context that it became harmful. Never mind, it's not important. I got the answer below and accepted it. — Adergaard
– Adergaard, Commented Aug 22, 2014 at 17:54

Not_a_Golfer · Accepted Answer · 2014-08-22 14:08:56Z

8

This is not db-safe, and you should use the database driver's escaping before putting anything in it.

You should use functions like sql.DB.Query() that let you pass arguments and properly escape them. http://golang.org/pkg/database/sql/#DB.Query

e.g.

userId := http.Request.URL.Query().Get("userId")

rows, err := db.Query("SELECT * FROM users WHERE id=?", userId)

answered Aug 22, 2014 at 14:08

Not_a_Golfer

49.5k15 gold badges130 silver badges95 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

what if userId == "1' or 1=1 -- -'INSERT INTO users ...'

@dalu it gets escaped in a way that wouldn't cause problems.