Language: Go
Label: vulnerable
CWE: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.

Code:
func (prp *PatternResourcePersister) GetPatternResources(search, order, name, namespace, typ, oamType string, page, pageSize uint64) (*PatternResourcePage, error) {
	order = sanitizeOrderInput(order, []string{"created_at", "updated_at", "name"})

	if order == "" {
		order = "updated_at desc"
	}

	count := int64(0)
	resources := []*PatternResource{}

	query := prp.DB.Order(order).Where("deleted = false")

	if search != "" {
		like := "%" + strings.ToLower(search) + "%"
		query = query.Where("(lower(pattern_resources.name) like ?)", like)
	}
	if name != "" {
		query = query.Where("name = ?", name)
	}
	if namespace != "" {
		query = query.Where("namespace = ?", namespace)
	}
	if typ != "" {
		query = query.Where("type = ?", typ)
	}
	if oamType != "" {
		query = query.Where("oam_type = ?", oamType)
	}

	query.Model(&PatternResource{}).Count(&count)

	Paginate(uint(page), uint(pageSize))(query).Find(&resources)

	patternResourcePage := &PatternResourcePage{
		Page:       page,
		PageSize:   pageSize,
		TotalCount: int(count),
		Resources:  resources,
	}

	return patternResourcePage, nil
}