sqlx VS go-sql-driver/mysql

sqlx for the database driver.

We've always used https://github.com/jmoiron/sqlx which is just the standard package + mapping to/from structs.

You can use this https://github.com/jmoiron/sqlx

I will be using sqlx to execute queries and map columns to struct fields and vice versa, sqlx is a library which provides a set of extensions on go's standard database/sql library.

sqlx + squirrel ftw

I'd rather suggest the use of tools more aligned with the core concepts of the language such as sqlx, which is an extension of the database/sql standard library. It allows you to use models/structs to map your tables but you have more control over the SQL statements you use to perform queries and the like. You can combine sqlx with Squirrel to build queries from composable parts.

IDE: use whatever make you productive. I personally use vscode. VCS: git, as golang communities use github heavily as base for many libraries. AFAIK Linter: use staticcheck for linting as it looks like mostly used linting tool in go, supported by many also. In Vscode it will be recommended once you install go plugin. Libraries/Framework: actually the standard libraries already included many things you need, decent enough for your day-to-day development cycles(e.g. `net/http`). But here are things for extra: - Struct fields validator: validator - Http server lib: chi router , httprouter , fasthttp (for non standard http implementations, but fast) - Web Framework: echo , gin , fiber , beego , etc - Http client lib: most already covered by stdlib(net/http), so you rarely need extra lib for this, but if you really need some are: resty - CLI: cobra - Config: godotenv , viper - DB Drivers: sqlx , postgre , sqlite , mysql - nosql: redis , mongodb , elasticsearch - ORM: gorm , entgo , sqlc(codegen) - JS Transpiler: gopherjs - GUI: fyne - grpc: grpc - logging: zerolog - test: testify , gomock , dockertest - and many others you can find here

This is the same situation I saw 20 years ago. Back then, all the managers were pushing development in Oracle tools. Those managers grew up on Oracle and Java was too modern for them. Now the situation is similar. Managers used to do things in Java and now they are still pushing Java. In fact, today Java brings nothing but problems. When I see a new project starting on Java it is always some big desperation. For a comparison of Java and Go, just look at the documentation for SQL. For go: https://pkg.go.dev/database/sql (31 pages) and maybe https://jmoiron.github.io/sqlx/ (12 pages). In Java only one class is 59 pages (https://docs.oracle.com/javase/8/docs/api/java/sql/ResultSet.html) and look how many of those documents there are: https://docs.oracle.com/en/java/javase/13/docs/api/java.sql/java/sql/package-summary.html and on top of that we have javax.sql - https://docs.oracle.com/javase/8/docs/api/javax/sql/package-summary.html And even then you use Hibernate for example, where the documentation has 11 manuals and of those the User Guide has 353 pages - https://docs.jboss.org/hibernate/orm/6.2/userguide/html\_single/Hibernate\_User\_Guide.html

Next, we need to install some dependencies. We already know we are using MySQL as our database, thus, we need to install the MySQL driver for Golang.

IDE: use whatever make you productive. I personally use vscode. VCS: git, as golang communities use github heavily as base for many libraries. AFAIK Linter: use staticcheck for linting as it looks like mostly used linting tool in go, supported by many also. In Vscode it will be recommended once you install go plugin. Libraries/Framework: actually the standard libraries already included many things you need, decent enough for your day-to-day development cycles(e.g. `net/http`). But here are things for extra: - Struct fields validator: validator - Http server lib: chi router , httprouter , fasthttp (for non standard http implementations, but fast) - Web Framework: echo , gin , fiber , beego , etc - Http client lib: most already covered by stdlib(net/http), so you rarely need extra lib for this, but if you really need some are: resty - CLI: cobra - Config: godotenv , viper - DB Drivers: sqlx , postgre , sqlite , mysql - nosql: redis , mongodb , elasticsearch - ORM: gorm , entgo , sqlc(codegen) - JS Transpiler: gopherjs - GUI: fyne - grpc: grpc - logging: zerolog - test: testify , gomock , dockertest - and many others you can find here

I understand that database/db is an abstraction. As to the driver, sorry, it completely went out of my head. The guide primarily focuses on https://github.com/go-sql-driver/mysql, which is also what I’m interested in.

Authentication method mismatch is not allowed to occur more than once. It is not a part of MySQL protocol. go-sql-driver also has the same rule.

If you are using https://github.com/go-sql-driver/mysql you need to add parseTime=true to the DSN to be able to use time.Time.

package models import ( "gorm.io/driver/mysql" "gorm.io/gorm" ) var DB *gorm.DB func ConnectDatabase() { // refer https://github.com/go-sql-driver/mysql#dsn-data-source-name for details dsn := "root:@tcp(127.0.0.1:3309)/fiber-pscale?charset=utf8mb4&parseTime=True&loc=Local" database, err := gorm.Open(mysql.Open(dsn), &gorm.Config{}) if err != nil { panic("failed to connect database") } // Migrate the users table database.AutoMigrate(&User{}) DB = database }

I've seen this error on line but there is no resolution to this error even when i run go get github.com/go-sql-driver/mysql

I use github.com/go-sql-driver/mysql package to use MySQL. The references are the official README.md, a sample code, the article Masao wrote (in Japanese), and the MariaDB document.

go-sql-driver/mysql 12.1k Stars, Used by 72.4k

> mysql_real_escape_string is still vulnerable when being used with some exotic character sets

Indeed -- mysql_real_escape_string "mostly" fixes this problem by requiring a connection as one of its args, and since it's usually aware of the connection state, it can check that to see if one of those exotic charsets is in-use. But the problem is that there are multiple ways to change the connection charset, some of which the driver is aware of (e.g. in PHP mysqli set_charset) but some it is not (running textual statements like SET NAMES or SET CHARACTER SET).

But generally an attacker won't ever have the ability to set an arbitrary exotic character set for the connection, unless they already have some other sql injection mechanism, in which case it's a moot point :)

Driver documentation also typically mentions this problem. For example, here's the doc for doing client-side param interpolation in the most popular MySQL driver for Golang: https://github.com/go-sql-driver/mysql#interpolateparams

It also explicitly detects if your initial connection settings attempt to use one of those charsets along with param interpolation, and throws an error if so: https://github.com/go-sql-driver/mysql/blob/21f789cd/dsn.go#...

> Couldn't one just save the extra round-trip with length-prefixed strings by sending the query together with the parameters in a single message?

AFAIK, no, not with the traditional MySQL binary protocol. The newer "X protocol" introduced in MySQL 5.7 does allow this, but it is not widely implemented in drivers.