我可以在Go中参数化create语句吗？

Question

Using the Go SQL library we can create SELECT, INSERT, UPDATE and DELETE statements with parameters like this:

db.Query("SELECT * FROM database.table WHERE param = ?", param_value)

I want to create tables from user provided input that describes the table structure, users will be asked for the name of the table and the name and type of each column they want to create. However, building a CREATE statement in the query interface Creating a CREATE statement by concatenating strings together works, but that's a SQL injection attack waiting to happen.

Is there a way to parameterize CREATE statements using the Go SQL library?

Answer 1

SQL query parameters take the place of a scalar value only.

That is, you can use a parameter to substitute only where you would otherwise use a constant quoted string, constant quoted date/time, or constant numeric.

SQL query parameters can't be used for:

• Table names, column names, or other identifiers
• SQL expressions
• Lists of scalar values (like in an IN(...) predicate)
• SQL keywords

The proper way to write your app that takes user input which describes table structure is to interpret the user input as a guide, not as literal SQL syntax. Avoid passing user input (or any unsafe content) through to be executed as part of any SQL statement.