skills.rest
liurida
liuridaCOMMUNITY
Explore all skills by this author →
GitHub

gorm-security

Enforce parameterized GORM queries to prevent SQL injection in Go backends.

Updated Apr 4, 2026
Search Tags:#security#go#input-validation#sql-injection#gorm#raw-sql#whitelist-validation
One-click install
npx skills add https://github.com/liurida/gorm-development-skill --skill gorm-security
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: gorm-security
Source: https://github.com/liurida/gorm-development-skill/tree/main/security
Command: npx skills add https://github.com/liurida/gorm-development-skill --skill gorm-security

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Protect Go applications that use GORM from SQL injection and unsafe dynamic queries by enforcing parameterized arguments, input validation, and whitelist checks to avoid executing attacker-controlled SQL.

Core Features & Use Cases

  • SQL injection prevention: Prescribe the use of parameter placeholders for all user-provided values and require numeric ID validation before use.
  • Whitelist validation for non-escaped methods: Provide patterns and helper functions to safely handle Order, Table, Select, Group, Joins, Raw, Exec, and gorm.Expr usage.
  • Audit and remediation guidance: Include a checklist and concrete code examples to find and fix vulnerable call sites during security reviews and CI checks.
  • Use Case: During a security audit of a Go backend, identify occurrences of fmt.Sprintf-based queries, unvalidated Order or Table calls, and raw SQL usages, then replace them with parameterized queries or whitelist-validated helpers.

Quick Start

Run an audit of your Go codebase and replace any fmt.Sprintf or unvalidated Order/Table/Raw usages with parameterized queries and whitelist checks using the guidance in this skill.

Frequently Asked Questions about gorm-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I prevent SQL injection in GORM raw SQL and dynamic queries?▼

Prevent SQL injection in GORM by enforcing parameterized placeholders instead of embedding user input. Replace fmt.Sprintf query construction with parameterized arguments and validate numeric IDs before use.

What is the best way to secure GORM Order, Table, and Group clauses from injection?▼

Secure GORM Order, Table, and Group clauses by applying whitelist validation for non-escaped methods. Use helper functions to validate dynamic column and table inputs against an allowed list before executing the query.

How do I audit Go code for unsafe gorm.Expr and fmt.Sprintf query usage?▼

Audit Go code for unsafe gorm.Expr and fmt.Sprintf usage by checking for parameterized placeholders and logging warnings for unvalidated patterns. Review WHERE, JOIN, and Raw call sites to identify attacker-controlled SQL execution.

Can I use whitelist validation for dynamic table and column inputs in GORM?▼

You can use whitelist validation for dynamic table and column inputs in GORM by checking user-provided values against a predefined set of allowed strings. This prevents injection in non-escaped methods like Select, Joins, and Exec.

When do I need parameterized queries instead of string concatenation in GORM?▼

You need parameterized queries in GORM whenever user input reaches WHERE, ORDER, GROUP, JOIN, RAW, or EXEC clauses. String concatenation risks SQL injection by allowing attacker-controlled SQL to execute directly on the database.

Related Skills

Explore More Software Engineering Skills→
liuridaliurida

gorm-generics-api

Provide type-safe CRUD and query operations for GORM models using Go generics.

Community
Intermediate
Clear-CapabilitiesClear-Capabilities
73

agentic-security:security-sql-injection-warn

Block unsafe SQL string concatenation and enforce parameterized queries during code editing.

Official
Intermediate
PrimadetaautomationPrimadetaautomation
5

security-essentials

Identify and remediate codebase security vulnerabilities using OWASP-aligned guidance.

Community
Advanced
hung-phanhung-phan

sqli

Identify and mitigate SQL injection vulnerabilities in production systems.

Community
Advanced