title: GoLang Dynamic SQL Query in App Engine
body: <p>I want to make dynamic sql in GoLang and I cant seem to find the correct way to do it. </p>
  
  <p>Basically, I just want to do:</p>
  
  <pre><code>query := "SELECT id, email, something FROM User"
  
  var paramValues []string
  filterString := ""
  
  if userParams.Name != "" {
      paramString += " WHERE id = ?"
      paramValues = append(paramValues, userParams.Name)
  }
  
  if userParams.UserID != "" {
      if len(paramString) &gt; 0 {
          paramString += " AND"
      } else {
          paramString += " WHERE"
      }
  
      paramString += " email = ?"
      paramValues = append(paramValues, userParams.UserID)
  }
  stmtOut, err := db.Prepare(query + paramString)
  
  err = stmtOut.QueryRow(paramValues).Scan(&amp;id, &amp;email, &amp;something)
  </code></pre>
  
  <p>Related to <a href="https://stackoverflow.com/questions/44548030/building-a-dynamic-query-in-mysql-and-golang">building a dynamic query in mysql and golang</a></p>
  
  <p>I've been unable to find a solid way to do this that doesn't allow sql injection. The issue with my above solution is that QueryRow() does not take a []string as a parameter.</p>
  
  <p>I want to protect from SQL Injection, so fmt.Sprintf doesn't really solve the problem.</p>
  
  <p>This way I can allow searches on user using either the ID or Email, and I will also use this logic for different objects with more searchable fields.</p>
  
  <p>I'm using go-sql-driver/mysql</p>