CodeVetter · local evidence export

SQL injection via fmt.Sprintf in Go

codevetter-public-benchmark/go-sql-injection

detected · high confidence

Verification

Code reviewcompleted

Qualified static finding recorded.

Executable testnot verified

No exact-current runtime evidence is included.

Audiencenot run

No audience validation occurred.

highbenchmark ground truth

User-supplied email is interpolated into the SQL query via fmt.Sprintf instead of parameterized placeholders, allowing injection of arbitrary SQL.

source.go:13