Lauren Voswinkel 1a322e2026

Use parameters when executing prepared statements rather than fmt.Sprintf (#9013) ...

* Don't use string formatting to prepare queries.

We should, when possible, use the built-in params and ? format when
preparing and executing a query. This is done to prevent SQL Injection
attacks.

* Revert some changes due to failing tests, update mssql go driver

* Add docker container startup for some MSSQL tests

* Remove acceptance test flagging, add more SQL injection protection

* Refactor MSSQL prepareTestContainer to a test helper

Also, remove all ? references and convert them to @p*

2020-05-21 16:07:18 -07:00

..

cmd/mssql

Update to api 1.0.1 and sdk 0.1.8

2019-04-15 14:10:07 -04:00

backend_test.go

Use parameters when executing prepared statements rather than fmt.Sprintf (#9013)

2020-05-21 16:07:18 -07:00

backend.go

Switch to go modules (#6585)

2019-04-13 03:44:06 -04:00

path_config_connection.go

Switch to go modules (#6585)

2019-04-13 03:44:06 -04:00

path_config_lease.go

Switch to go modules (#6585)

2019-04-13 03:44:06 -04:00

path_creds_create.go

Update to api 1.0.1 and sdk 0.1.8

2019-04-15 14:10:07 -04:00

path_roles.go

Switch to go modules (#6585)

2019-04-13 03:44:06 -04:00

secret_creds.go

Use parameters when executing prepared statements rather than fmt.Sprintf (#9013)

2020-05-21 16:07:18 -07:00

util.go

Adding verify_connection to config, docs updates, misc cleanup

2016-03-09 23:08:05 -05:00