CVE-2026-100644: Go Sql Injection Concat Into Quoted Sql Literalcve-2026-100644-go-sql-injection-concat-into-quoted-sql-literal
$VAL is concatenated directly into a single-quoted SQL string literal. A single quote in $VAL terminates the literal and lets an attacker append arbitrary SQL (e.g. UNION SELECT) to the statement. Escape quotes before concatenation (e.g. strings.ReplaceAll($VAL, "'", "''")) or use a bound parameter instead.
