On: Building a Web Server in Go: Handling User Input

[jwcrux]

The sql package in the standard library has support for parameterized queries, so you should use those instead of some random function to check for injections.