Don't pass params to SQL statements using fmt.Sprintf()

Author: dhui

database/firebird/firebird.go

@@ -138,13 +138,16 @@ func (f *Firebird) SetVersion(version int, dirty bool) error {
 		return nil
 	}
 
+	// TODO: parameterize this SQL statement
+	//       https://firebirdsql.org/refdocs/langrefupd20-execblock.html
+	//       VALUES (?, ?) doesn't work
 	query := fmt.Sprintf(`EXECUTE BLOCK AS BEGIN
 					DELETE FROM "%v";
 					INSERT INTO "%v" (version, dirty) VALUES (%v, %v);
 				END;`,
 		f.config.MigrationsTable, f.config.MigrationsTable, version, btoi(dirty))
 
-	if _, err := f.conn.ExecContext(context.Background(), query, version, btoi(dirty)); err != nil {
+	if _, err := f.conn.ExecContext(context.Background(), query); err != nil {
 		return &database.Error{OrigErr: err, Query: []byte(query)}
 	}
 

database/ql/ql.go

@@ -85,7 +85,7 @@ func (m *Ql) ensureVersionTable() (err error) {
 		return err
 	}
 	if _, err := tx.Exec(fmt.Sprintf(`
-	CREATE TABLE IF NOT EXISTS %s (version uint64,dirty bool);
+	CREATE TABLE IF NOT EXISTS %s (version uint64, dirty bool);
 	CREATE UNIQUE INDEX IF NOT EXISTS version_unique ON %s (version);
 `, m.config.MigrationsTable, m.config.MigrationsTable)); err != nil {
 		if err := tx.Rollback(); err != nil {
@@ -211,8 +211,9 @@ func (m *Ql) SetVersion(version int, dirty bool) error {
 	}
 
 	if version >= 0 {
-		query := fmt.Sprintf(`INSERT INTO %s (version, dirty) VALUES (%d, %t)`, m.config.MigrationsTable, version, dirty)
-		if _, err := tx.Exec(query); err != nil {
+		query := fmt.Sprintf(`INSERT INTO %s (version, dirty) VALUES (uint64(?1), ?2)`,
+			m.config.MigrationsTable)
+		if _, err := tx.Exec(query, version, dirty); err != nil {
 			if errRollback := tx.Rollback(); errRollback != nil {
 				err = multierror.Append(err, errRollback)
 			}

database/sqlite3/sqlite3.go

@@ -212,8 +212,8 @@ func (m *Sqlite) SetVersion(version int, dirty bool) error {
 	}
 
 	if version >= 0 {
-		query := fmt.Sprintf(`INSERT INTO %s (version, dirty) VALUES (%d, '%t')`, m.config.MigrationsTable, version, dirty)
-		if _, err := tx.Exec(query); err != nil {
+		query := fmt.Sprintf(`INSERT INTO %s (version, dirty) VALUES (?, ?)`, m.config.MigrationsTable)
+		if _, err := tx.Exec(query, version, dirty); err != nil {
 			if errRollback := tx.Rollback(); errRollback != nil {
 				err = multierror.Append(err, errRollback)
 			}