<p>Is golangs database drivers or the ORM layer handle the sql injection itself? or if not are there any extra layer to use to protect sql injection.</p>
<hr/>**评论：**<br/><br/>TheMerovius: <pre><p>If you use prepared statements, there are no SQL injections. The go database API does strongly encourage using prepared statements. Unless you manually <code>fmt.Sprintf</code> together the string passed to <a href="https://godoc.org/database/sql#DB.Exec" rel="nofollow">Exec</a> and the like, you don't have to worry about it.</p></pre>carsncode: <pre><p>If you are actually using ORM, then SQL injections are the responsibility of the ORM framework to prevent. With ORM, you're not writing SQL, so there is nowhere for you to be concerned with SQL injection.</p>
<p>If you're just talking about database drivers, then the same advice applies in go as it does in every other language: always use prepared statements. </p></pre>thesilentwitness: <pre><p>Sort of. SQL injections are the responsibility of the driver, however if the ORM does not utilise query parameters properly it can bypass that. </p></pre>
