SQL injection from Lambda event data in database/sql query in AWS Lambda

Critical Risk sql-injection
gogolangaws-lambdadatabase-sqlsql-injection

What it is

SQL injection vulnerability where fields from the Lambda event are concatenated into SQL strings instead of using parameters, potentially allowing attackers to read, modify, or delete data, escalate privileges, and run unintended queries against the database by altering the query structure through attacker-controlled input.

package main

import (
    "context"
    "database/sql"
    "fmt"
    "github.com/aws/aws-lambda-go/events"
    "github.com/aws/aws-lambda-go/lambda"
    _ "github.com/lib/pq"
)

func handleRequest(ctx context.Context, request events.APIGatewayProxyRequest) (events.APIGatewayProxyResponse, error) {
    db, _ := sql.Open("postgres", connectionString)
    defer db.Close()
    
    userID := request.PathParameters["userId"]
    search := request.QueryStringParameters["search"]
    status := request.QueryStringParameters["status"]
    
    // VULNERABLE: fmt.Sprintf with path parameter
    query := fmt.Sprintf("SELECT * FROM users WHERE id = '%s'", userID)
    db.QueryContext(ctx, query)
    
    // VULNERABLE: fmt.Sprintf with query parameters
    searchQuery := fmt.Sprintf(
        "SELECT * FROM users WHERE name LIKE '%%%s%%' AND status = '%s'",
        search, status,
    )
    db.QueryContext(ctx, searchQuery)
    
    return events.APIGatewayProxyResponse{StatusCode: 200}, nil
}

func main() {
    lambda.Start(handleRequest)
}
package main

import (
    "context"
    "database/sql"
    "github.com/aws/aws-lambda-go/events"
    "github.com/aws/aws-lambda-go/lambda"
    _ "github.com/lib/pq"
)

func handleRequest(ctx context.Context, request events.APIGatewayProxyRequest) (events.APIGatewayProxyResponse, error) {
    db, _ := sql.Open("postgres", connectionString)
    defer db.Close()
    
    userID := request.PathParameters["userId"]
    search := request.QueryStringParameters["search"]
    status := request.QueryStringParameters["status"]
    
    // SECURE: $1 placeholder
    db.QueryContext(ctx, "SELECT * FROM users WHERE id = $1", userID)
    
    // SECURE: $1, $2 placeholders
    db.QueryContext(
        ctx,
        "SELECT * FROM users WHERE name LIKE $1 AND status = $2",
        "%"+search+"%", status,
    )
    
    return events.APIGatewayProxyResponse{StatusCode: 200}, nil
}

func main() {
    lambda.Start(handleRequest)
}

💡 Why This Fix Works

The vulnerable code uses fmt.Sprintf to build SQL queries with Lambda event data, allowing SQL injection attacks. The fixed version uses parameterized queries with $1, $2 placeholders to safely bind all user-controlled values.

Why it happens

Lambda event fields are directly concatenated or formatted into SQL query strings using fmt.Sprintf or string concatenation.

Root causes

Event Field String Concatenation

Lambda event fields are directly concatenated or formatted into SQL query strings using fmt.Sprintf or string concatenation.

Missing Parameter Binding

Failing to use database/sql parameterized queries with placeholders and parameter binding.

Fixes

1

Use Parameterized Queries with Placeholders

Replace string concatenation with placeholders (? or $1) and pass values as parameters via Query, QueryContext, or Exec methods.

View implementation 
db.Query("SELECT * FROM users WHERE id = ?", userId) or db.QueryContext(ctx, "SELECT * WHERE id = $1", userId)
2

Use Prepared Statements

For repeated queries, use Prepare/PrepareContext to create prepared statements for better performance and security.

View implementation 
stmt, err := db.PrepareContext(ctx, "SELECT * FROM users WHERE id = ?"); rows, err := stmt.QueryContext(ctx, userId)
3

Validate Event Input

Implement comprehensive validation for all Lambda event fields before using them in database operations.

View implementation 
Check data types, validate formats, enforce length limits, and use allow-lists for expected values

Detect This Vulnerability in Your Code

Sourcery automatically identifies sql injection from lambda event data in database/sql query in aws lambda and many other security issues in your codebase.

Scan Your Code for Free Explore More Vulnerabilities