SQL注入示例

//xc_Data查询
func queryTestXCdata(xcdata XCDataStu) (string, int) {
	result := make([]XCDataStu, 0)
	var querySql string
	querySql = "SELECT * FROM xc_Data"
	if xcdata.Id > 0 {
		querySql = querySql + " where id=" + intToString(xcdata.Id)
	} else {
		return errorStruct(-1, "参数有误")
	}

	Debug(querySql)
	mysqlDB.XormSql(querySql).Find(&result)
	return errorDataStruct(Success, "ok", &result)
}

func queryTestXCdata(xcdata XCDataStu) (string, int) {
	result := make([]XCDataStu, 0)
	var querySql string
	querySql = "SELECT * FROM xc_Data"
	if xcdata.Id > 0 {
		querySql = querySql + " where id=" + intToString(xcdata.Id)
	} 
	Debug(querySql)
	mysqlDB.XormSql(querySql).Find(&result)
	return errorDataStruct(Success, "ok", &result)
}

	xcData.Id = -1
	if responseStr, ret := queryTestXCdata(xcData); ret != Success {
		Warning("queryTestXCdata not Success,", errormap[ret], ret)
		return
	} else {
		fmt.Println(responseStr)
	}