markbates/soda — pull request #2 by timraymond (2014-11-05 04:32:07+00:00)
Title: Change Arguments to use DB Bind Vars & Prepared Statements

Previously, we were interpolating arguments using Sprintf, which can expose use to SQL injection attacks. This switches all methods which consume arguments to collect them in structs along with the query fragment they will be interpolated into. When the resultant query is built, all of the fragments are concatenated into the final query with MySQL-style bind vars, and all of the arguments are concatenated into one `[]interface{}`. These two are passed to SQLx where the driver handles compiling the query, and exec'ing it with the arguments. If the dialect is specified as Postgres, question mark style placeholders should still be used. These will be substituted for Postgres-style bind vars (`$1`, `$2`, ...) when the finaly query is built.