Use parameterized sql. Pretty sure this is how to do it in Go anyway.