%s is not safe with quotes

[alexions]

Maybe I missed some information, but if string contains a quote, you will get a fatal error

login := "hack"er"
db.Query("SELECT * FROM users WHERE login = "?s"", login)

Received #1064 error from MySQL server: "You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '"er' at line 1"

How can I safely insert any strings?

[ziutek]

Use Conn.Escape method or better use prepared statement.

[alexions]

Thank you, it's work fine. But why it cannot be done "automatically" for all of %s placeholders?

[ziutek]

db.Query performs string query. It doesn't parse any format string and knows nothing about placeholders. It simply pass its arguments to fmt.Sprintf (in very old version you need to do this manually).

I strongly recommend use prepared statements for queries that need some arguments. It is safer than perform text query. Nowadays, text queries should be used only for very simple queries.