Help us understand the problem. What is going on with this article?

BeegoのORMの使い方(RAWで生のSQLを書く)

これはGolangのフレームワークBeegoで生のSQLを書きたいときに参考にできるソース

だれかBeegoのSQLインジェクションの詳細を調べてほしい…

公式サイト
Beego Raw

・やっとくといいこと(Beegoのormをデバックモードにする)
 →これをすると発行されるSQLを確認できる。

// これをconf/xxx.confとかに書いておくと環境別に分けられる
// database.debug = true

debug, _:= beego.AppConfig.Bool("database.debug");
if (debug == true) {
    orm.Debug = true
}

Raw関数を使用して直接SQLを発行

package models

import (
    _ "errors"
    "fmt"
    _ "strings"

    "github.com/astaxie/beego"
    "github.com/astaxie/beego/orm"
)

type User struct {
    Id       int
    Name     string `orm:"size(128)"`
    UserName string `orm:"size(128)"`
    Email    string `orm:"size(128)"`
    Token    string `orm:"size(128)"`
    Avatar   string `orm:"size(128)"`
}

func init() {
    orm.RegisterModel(new(User))
}

// 使用するサービス関数
func GetUserByEmail(email string)(v *User, err error) {
    // ほかのORM同様にnewする
    o := orm.NewOrm()
    // Raw関数を使用してSQLを発行
    err = o.Raw("SELECT * FROM user where email = ?", email).QueryRow(&v)
    if err == nil {
    }else{
        beego.Error(err)
        return nil, err
    }
    return v, nil
}

NewQueryBuilderを使う

func LoginSubmit(username string, email string)(user *User, err error) {

    qb, _ := orm.NewQueryBuilder("mysql")
    qb.Select("*").From("user_d_b").Where(fmt.Sprintf("name='%s'", username)).And(fmt.Sprintf("email='%s'", email))
    sql := qb.String()
    o.Raw(sql).QueryRow(&userDB)
    if user.Id == 0 {
        return false
    }
    return true
}
Why do not you register as a user and use Qiita more conveniently?
  1. We will deliver articles that match you
    By following users and tags, you can catch up information on technical fields that you are interested in as a whole
  2. you can read useful information later efficiently
    By "stocking" the articles you like, you can search right away
Comments
Sign up for free and join this conversation.
If you already have a Qiita account
Why do not you register as a user and use Qiita more conveniently?
You need to log in to use this function. Qiita can be used more conveniently after logging in.
You seem to be reading articles frequently this month. Qiita can be used more conveniently after logging in.
  1. We will deliver articles that match you
    By following users and tags, you can catch up information on technical fields that you are interested in as a whole
  2. you can read useful information later efficiently
    By "stocking" the articles you like, you can search right away