Language: Go
Label: vulnerable
CWE: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.

Code:
func (*FailedEventsManagerT) SaveFailedRecordIDs(taskRunIDFailedEventsMap map[string][]*FailedEventRowT, txn *sql.Tx) {
	if !failedKeysEnabled {
		return
	}

	for taskRunID, failedEvents := range taskRunIDFailedEventsMap {
		table := fmt.Sprintf(`%s_%s`, failedKeysTablePrefix, taskRunID)
		sqlStatement := fmt.Sprintf(`CREATE TABLE IF NOT EXISTS %s (
		destination_id TEXT NOT NULL,
		record_id JSONB NOT NULL,
		created_at TIMESTAMP NOT NULL);`, table)
		_, err := txn.Exec(sqlStatement)
		if err != nil {
			_ = txn.Rollback()
			panic(err)
		}
		insertQuery := fmt.Sprintf(`INSERT INTO %s VALUES($1, $2, $3);`, table)
		stmt, err := txn.Prepare(insertQuery)
		if err != nil {
			_ = txn.Rollback()
			panic(err)
		}
		createdAt := time.Now()
		for _, failedEvent := range failedEvents {
			if len(failedEvent.RecordID) == 0 || !json.Valid(failedEvent.RecordID) {
				pkgLogger.Infof("skipped adding invalid recordId: %s, to failed keys table: %s", failedEvent.RecordID, table)
				continue
			}
			_, err = stmt.Exec(failedEvent.DestinationID, failedEvent.RecordID, createdAt)
			if err != nil {
				panic(err)
			}
		}

		stmt.Close()
	}
}