Language: Go
Label: vulnerable
CWE: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.

Code:
func (r *MySQL) Probe() (bool, string) {

	if r.tls != nil {
		mysql.RegisterTLSConfig(global.DefaultProg, r.tls)
	}

	db, err := sql.Open("mysql", r.ConnStr)
	if err != nil {
		return false, err.Error()
	}
	defer db.Close()

	// Check if we need to query specific data
	if len(r.Data) > 0 {
		for k, v := range r.Data {
			log.Debugf("[%s / %s / %s] - Verifying Data - [%s] : [%s]", r.ProbeKind, r.ProbeName, r.ProbeTag, k, v)
			sql, err := r.getSQL(k)
			if err != nil {
				return false, err.Error()
			}
			log.Debugf("[%s / %s / %s] - SQL - [%s]", r.ProbeKind, r.ProbeName, r.ProbeTag, sql)
			rows, err := db.Query(sql)
			if err != nil {
				return false, err.Error()
			}
			if !rows.Next() {
				rows.Close()
				return false, fmt.Sprintf("No data found for [%s]", k)
			}
			//check the value is equal to the value in data
			var value string
			if err := rows.Scan(&value); err != nil {
				rows.Close()
				return false, err.Error()
			}
			if value != v {
				rows.Close()
				return false, fmt.Sprintf("Value not match for [%s] expected [%s] got [%s] ", k, v, value)
			}
			rows.Close()
			log.Debugf("[%s / %s / %s] - Data Verified Successfully! - [%s] : [%s]", r.ProbeKind, r.ProbeName, r.ProbeTag, k, v)
		}
	} else {
		err = db.Ping()
		if err != nil {
			return false, err.Error()
		}
		row, err := db.Query("show status like \"uptime\"") // run a SQL to test
		if err != nil {
			return false, err.Error()
		}
		defer row.Close()
	}

	return true, "Check MySQL Server Successfully!"

}