Is this a secure query?

I want to have a “dynamic” column in order to chose translation. Is this a safe way to do this?

import (
    "context"
    "github.com/jackc/pgx/v4/pgxpool"
)

func main() {
    language := "en_US"
    translationKey := "co"

    // create a database connection pool
    dbpool, err := pgxpool.Connect(context.Background(), "postgres://user:password@host:port/database")
    if err != nil {
        panic(err)
    }
    defer dbpool.Close()

    // prepare the query statement with placeholders for parameters
    stmt, err := dbpool.Prepare(context.Background(), "SELECT $1 FROM lang WHERE column = $2 AND key = $3")
    if err != nil {
        panic(err)
    }
    defer stmt.Close()

    // execute the prepared statement with the translation key and language as parameters
    var translation string
    err = stmt.QueryRow(context.Background(), language, "en_US", "co").Scan(&translation)
    if err != nil {
        panic(err)
    }

    fmt.Println(translation)
}

This topic was automatically closed 90 days after the last reply. New replies are no longer allowed.