title: How can I prevent SQL injection attacks in Go while using "database/sql"?
body: <p>Building my first web-app and want to understand SQL injection better (<a href="https://github.com/astaxie/build-web-application-with-golang/blob/master/en/eBook/09.4.md" rel="noreferrer">https://github.com/astaxie/build-web-application-with-golang/blob/master/en/eBook/09.4.md</a>).</p>
  
  <p>How much protection against SQL injection do I get from just always using the 'database/sql' library and constructing queries using '?' instead of concatting strings?  What kind of SQL injection attacks will I still have to worry about in that case?</p>