A static analysis tool for Go that validates raw SQL queries to catch syntax errors and prevent SQL injections.
Sqlvet is a static analysis tool for Go that examines raw SQL queries embedded in source code. It helps developers identify potential runtime errors and security vulnerabilities, such as SQL syntax issues and injection risks, during the build phase to enhance code safety.
Go developers working with database-driven applications who embed raw SQL queries in their code, particularly those using libraries like database/sql, sqlx, gorm, or gorp.
Developers choose Sqlvet for its ability to shift SQL error detection from runtime to compile time, reducing bugs and security risks. It offers configurable validation against database schemas and supports custom query functions from various Go SQL libraries.
Go fearless SQL. Sqlvet performs static analysis on raw SQL queries in your Go code base.
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Shifts SQL syntax errors and injection risks from runtime to build time, catching issues early as emphasized in the project philosophy.
Verifies table and column names against a provided database schema, enhancing query accuracy when configured via sqlvet.toml.
Configurable to analyze query functions from various Go SQL libraries like sqlx and gorm, adapting to diverse codebases with TOML rules.
Allows ignoring specific lines with 'sqlvet: ignore' comments, reducing noise in analysis reports for practical use.
Lacks support for MySQL syntax and advanced validations like argument type checking, as admitted in the TODO list, limiting coverage.
Full validation requires a static schema file; without it, key checks are skipped, reducing effectiveness in dynamic or schema-less setups.
Setting up custom query functions involves detailed TOML configuration for sqlfunc_matchers, which can be cumbersome and error-prone.