irongit

A series of universal tools for go projects.

golib/querytools/queryin.go
27 lines519 BGo
1package querytools
2
3import (
4 "fmt"
5 "strings"
6
7 "github.com/gin-gonic/gin"
8)
9
10func QueryInToSql(c *gin.Context, prefix, db_field, query_field, def string) string {
11 s := c.Query(query_field)
12 if s == "" {
13 s = def
14 }
15 if s == "all" {
16 return ""
17 }
18 vals := strings.Split(s, ",")
19
20 // Prevent SQL injection by escaping single quotes
21 for i, v := range vals {
22 vals[i] = "'" + strings.ReplaceAll(v, "'", "''") + "'"
23 }
24
25 stmt := fmt.Sprintf("%s %s IN (%s)", prefix, db_field, strings.Join(vals, ", "))
26 return stmt
27}