Software Architecture in Golang: Security - Databases, SQL Injection and Permissions

Securing database access to prevent unauthorized access and SQL injections is something we must consider when interacting with databases. The standard library provides a way to prevent SQL injection but because we have the freedom to create queries using string concatenation we could be in trouble when doing it incorrectly. == What is SQL Injection? "SQL injection is a code injection technique used to attack data-driven applications, in which malicious SQL statements are inserted into an entry field for execution." (Quote from Wikipedia: https://en.wikipedia.org/wiki/SQL_inj...) == How can we prevent SQL injection? By using Prepared Statements, identified by placeholders (Like $1, $2 in PostgreSQL and ? in MySQL); in those cases were creating queries with dynamic conditions instead of using manual string concatenation I recommend using a query builders, like "Masterminds/squirrel", this way the placeholders are still honored but the actual call is made by the database driver. == Using Permissions to Secure databases To secure databases on the backend can also create dedicated database users with their corresponding access, basically two users one for CRUD actions (Insert, Select, Update and Delete) that happens to only access the Write/Read cluster, and another one for R actions (Select) with access to the Read-Only cluster. == Relevant Links Security Considerations to take when using GORM: https://gorm.io/docs/security.html PostgreSQL driver and toolkit for Go: https://github.com/jackc/pgx Fluent SQL generation for golang: https://github.com/Masterminds/squirrel "Golang Microservices: PostgreSQL: gorm and sqlboiler"    • Golang Microservices: PostgreSQL: gorm and...   "Golang Microservices: PostgreSQL: sqlx, pgx and sql"    • Golang Microservices: PostgreSQL: sqlx, pg...   "Golang Microservices: PostgreSQL via sqlc, squirrel"    • Golang Microservices: PostgreSQL via sqlc,...   Example code: https://github.com/MarioCarrion/video... Previous Episode: "Software Architecture in Golang: Security - Dependencies":    • Software Architecture in Golang: Security ...   == All Go/Golang video series covered Playlist "Software Architecture in Go/Golang":    • Software Architecture and System Design in...   Playlist "Learning Go/Golang":    • Learning Go/Golang   Playlist "Learning Go/Golang Concurrency Patterns"    • Learning Go/Golang Concurrency Patterns   Playlist "Building Microservices in Go/Golang":    • Building Microservices in Golang/Go   Playlist "Go/Golang Tools and Packages":    • Golang/Go Tools and Packages   Playlist "Testing in Go/Golang":    • Testing in Golang/Go   00:00 - Start 00:26 - What is SQL Injection? Go/Golang Example 05:03 - Example of Preventing SQL Injection in Go/Golang 07:34 - Example building Dynamic Queries and also Preventing SQL Injection in Go/Golang 12:11 - Using Permissions to Secure Databases 14:35 - Conclusion --- Who am I: Hello👋🏼! I'm Mario, a Hands-on Software Architect and Lead Backend Engineer with more than 16 years of professional experience building all kinds of software including on-premise Industrial Automation Systems, Linux Accessibility Desktop and Browser Components as well as Distributed Advertising Microservices. Every week I will share with you different topics I've learned while working for small startups and large companies including the processes I've followed over the years for successfully delivering complex enterprise systems from start to end. Subscribe if you like Software Development, Software Architecture and Systems Design! Keep it up. Don't give up! #golang #security #softwarearchitecture --- Our affiliate links below Shop our Amazon favorites → https://www.amazon.com/shop/rubycarrion Shop my IG feed on my LIKEtoKNOWit (LTK) page → https://www.liketoknow.it/RubyCarrion Shop Top Deals and Featured Offers at Best Buy → https://bestbuy.7tiv.net/c/2558226/68... Get a 30 day FREE Trial of Epidemic Sound → https://www.epidemicsound.com/referra... Try Amazon Prime 30-day FREE Trial → https://amzn.to/3yf9a0f I love getting Cash Back and think you will too! Join for FREE and get $30 when you spend $30 → https://www.rakuten.com/r/RUBYRA132?e... --- Our Vlog Channel    / rubycarrion