Golang Sprintf formatting a string and using it multiple times

Question

I try to generate a sql query using Sprintf() where I have to use the same variable two times

myStr := "test"
str := Sprintf("SELECT ... WHERE a = '%#[1]s' or b = '%#[1]s'", myStr)
fmt.Println(str)

This snippets outputs the expected string

SELECT ... WHERE a = 'test' or b = 'test'

but go vet says:

unrecognized printf flag for verb 's': '#' (vet)

And I am puzzled why. Switching the printf verb to v satisfies go vet but adds " around my string. And I honestly doesn't see a mistake in using %#[1]s.

Any thoughts?

What do you expect the flag # to do with strings s? What in the package documentation makes you believe # modifies the verb s? — Volker
– Volker, Commented Nov 7, 2017 at 10:20

Hein Oldewage · Accepted Answer · 2017-11-07 10:30:13Z

5

Using printf to construct queries is a bad idea, it opens you up to SQL injection.

See named parameters in the sql package.

answered Nov 7, 2017 at 10:30

Hein Oldewage

2901 silver badge3 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Trev Over a year ago

great tip, but doesn't answer the question

AleGra · Accepted Answer · 2017-11-08 16:14:15Z

4

There is no # Sprintf flag for a string verb (the flag # is e.g. adding 0x for hex values: %#x). So remove it to make your go vet troubles disappear:

myStr := "test"
str := Sprintf("SELECT ... WHERE a = '%[1]s' or b = '%[1]s'", myStr)
fmt.Println(str)

But: If any part of your constructed query (myStr) comes from external input (i.e. user input), you really should follow Hein's advise and use named parameters.

answered Nov 8, 2017 at 16:14

AleGra

1364 bronze badges

Collectives™ on Stack Overflow

Golang Sprintf formatting a string and using it multiple times

2 Answers 2

1 Comment

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

1 Comment

Comments

Your Answer

Sign up or log in

Post as a guest

Related