Audit required: Tainted value reached a sinkGO-S7000

Unsanitized user input reaches a sink.

Examples

Bad practice

package main

import (
    "context"
    "database/sql"
    "fmt"
)

func foo(db *sql.Conn, input string) {
    db.ExecContext(context.TODO(), fmt.Sprintf("SELECT * FROM users where id = %s", input))
}

Recommended

package main

import (
    "context"
    "database/sql"
)

func foo(db *sql.Conn, input string) {
    db.ExecContext(context.TODO(), "SELECT * FROM users where id = ?", id)
}