This lesson's interactive features are locked, please to keep using them

Fixing SQL Injection

The best defense against SQL injection is to parameterize every untrusted value. A parameterized query sends SQL text and values to the database separately:

rows, err := database.QueryContext(
    ctx,
    "SELECT id, name FROM products WHERE name LIKE ? LIMIT ?",
    "%"+query+"%",
    maxResults,
)

The database parses the statement's structure before binding query and maxResults as data. Quotes and comment markers inside those values cannot become SQL syntax.

Query generators such as sqlc preserve that boundary while adding compile-time types. Bearly Secure already has a generated SearchActiveProducts query, so application code can call it without constructing SQL at runtime.

Assignment

Bearly Secure builds its product-search SQL with string concatenation. Replace the dynamic statement with the existing parameterized sqlc query.

Reset the database and start the app:
```
go run ./cmd/seed
go run ./cmd/server
```
Visit http://localhost:3030/search?q=' OR 1%3D1) --. Confirm the injected search returns products that do not match the search term.
In internal/storefront/store.go, update Store.SearchProducts to call the generated SearchActiveProducts query with:
- A search pattern containing the supplied query between % wildcards
- The existing maximum-results value
Return the mapped products and remove the now-unused raw-query construction.

With Bearly Secure still running, run and submit the CLI tests from the project root.