Language: Go
Label: vulnerable
CWE: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.

Code:
func (ppp *PerformanceProfilePersister) GetPerformanceProfiles(_, search, order string, page, pageSize uint64) ([]byte, error) {
	order = sanitizeOrderInput(order, []string{"updated_at", "created_at", "name", "last_run"})
	if order == "" {
		order = "updated_at desc"
	}

	count := int64(0)
	profiles := []*PerformanceProfile{}

	query := ppp.DB.
		Select(`
		id, name, load_generators,
		endpoints, qps, service_mesh,
		duration, request_headers, request_cookies,
		request_body, content_type, created_at,
		updated_at, (?) as last_run, (?) as total_results`,
			ppp.DB.Table("meshery_results").Select("DATETIME(MAX(meshery_results.test_start_time))").Where("performance_profile = performance_profiles.id"),
			ppp.DB.Table("meshery_results").Select("COUNT(meshery_results.name)").Where("performance_profile = performance_profiles.id"),
		).
		Order(order)

	if search != "" {
		like := "%" + strings.ToLower(search) + "%"
		query = query.Where("(lower(performance_profiles.name) like ?)", like)
	}

	query.Table("performance_profiles").Count(&count)

	Paginate(uint(page), uint(pageSize))(query).Find(&profiles)

	performanceProfilePage := &PerformanceProfilePage{
		Page:       page,
		PageSize:   pageSize,
		TotalCount: int(count),
		Profiles:   profiles,
	}

	return marshalPerformanceProfilePage(performanceProfilePage), nil
}