From 0dc3248f74adeb15fe5a9795e2907c72b6d501b8 Mon Sep 17 00:00:00 2001 From: Denis Arh Date: Sun, 24 Apr 2022 09:17:35 +0200 Subject: [PATCH] Make all (goqu) sql statements prepared --- store/adapters/rdbms/rdbms.go | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/store/adapters/rdbms/rdbms.go b/store/adapters/rdbms/rdbms.go index 038c1481f..ff8949268 100644 --- a/store/adapters/rdbms/rdbms.go +++ b/store/adapters/rdbms/rdbms.go @@ -6,6 +6,7 @@ import ( "fmt" "github.com/cortezaproject/corteza-server/store" + "github.com/doug-martin/goqu/v9" "github.com/doug-martin/goqu/v9/exec" "go.uber.org/zap" ) @@ -30,6 +31,12 @@ type ( } ) +func init() { + // goqu should always use placeholders! + // https://doug-martin.github.io/goqu/docs/interpolation.html + goqu.SetDefaultPrepared(true) +} + func (s Store) Exec(ctx context.Context, q sqlizer) error { var ( query, args, err = q.ToSQL()