Hello! Please tell me there is an application that accepts requests for http and converts it to the corresponding function in postgres. During the post-request in the URL, one numeric parameter is transmitted, the other is transmitted in the request body in the form of json. The question is: postgres accepts json in single quotes, how to implement "wrapping" the request body in single quotes or is it accepted to send json in the request body already in them?

P.S. I tried using the replace functions of the bytes and string packages, tried using append, but it seems to me that this is somehow easier to implement)

here's how to substitute the values

rows, err := db.Query("Select * from test.user_comment_ins($1,$2)", userID, body)

where body is the data from the POST request:

 curl -d {"txt":"cheers"} -H "Content-Type: application/json" -X POST http://127.0.0.1:8080/api/v1/user/5/comment/

if I send it with single quotes, then everything passes and the result of the POST request is returned:

 curl -d '{"txt":"cheers"}' -H "Content-Type: application/json" -X POST http://127.0.0.1:80/api/v1/user/5/comment/

can the point is that initially the second option is the standard for sending json, or do you need to perform any manipulations?

  • one
    Why json wrapped in quotes? Would you like to say that you are inserting a variable with the data directly into the request text? You should never do this (unless you want to be hacked, of course). Use prepared expressions and variable bindings. github.com/go-sql-driver/mysql/wiki/… - Mike
  • Nothing needs to be wrapped. Just pass as a string. - Ainar-G
  • @ Ainar-G supplemented the essence of the problem in the post, it is still not possible to transmit without error ( - Dmitry Milevsky

2 answers 2

Your problem is not go, but in the curtain. Of course you do everything when you escape quotes. When you write {"txt":"cheers"} understand it as {txt:cheers} , which is not the correct JSON.

Read about screening !

    Very much depends on how the connection to the database is implemented. If standard tools are used, then you can simply pass the json-string argument.

     package x import ( "database/sql" _ "github.com/lib/pq" // Postgres driver ) // подключение к базе данных и так далее func sendJSONString(db *sql.DB, js string) (err error) { _, err = db.Exec(`INSERT INTO table (column) VALUES ($1)`, js) return }

    See also about SQL code injection , also known as SQL Injection .