rather than string-assemble this can you use arguments to Exec (throughout) -- this protects against sql injection attacks.

IMO, according to https://www.postgresql.org/docs/current/xfunc-sql.html#XFUNC-SQL-FUNCTION-ARGUMENTS: SQL function arguments can only be used as data values, not as identifiers. replacing the table name with $1 does not seem to work.

I think Travis maybe means that you shouldn't Sprintf into package sql calls like Exec, but rather use the args of each method, e.g. look at the example at https://pkg.go.dev/database/sql#example-Conn.ExecContext

result, err := conn.ExecContext(ctx,UPDATE balances SET balance = balance + 10 WHERE user_id = ?;, id)

See how id is passed into the SQL query?

Yes that's what I meant.

I think I may be getting it, but it seems difficult to do this if we wants to keep the table name as a parameter create table ? or create table $1 will both report an error, and I have to use the Sprint function and do Sanitize() when the user passes in the table name.

Or, we can fix the table name to be a constant and unchangeable.

Everywhere else, $1 is used to replace the parameter.

kindly ping @eliben @tmc

I think Travis maybe means that you shouldn't Sprintf into package sql calls like Exec, but rather use the args of each method, e.g. look at the example at https://pkg.go.dev/database/sql#example-Conn.ExecContext

result, err := conn.ExecContext(ctx,UPDATE balances SET balance = balance + 10 WHERE user_id = ?;, id)

See how id is passed into the SQL query?