SQL Injection - go-pg ORM string concatenation

[elfgoh]

I have the following line in my code:

found, err := models.Projects(qm.Where("name =?", projectName)).One(ctx, db)

which triggered a security warning

SQL Injection - go-pg ORM string concatenation

I had thought that using ? was sufficient for sanitization but perhaps I am mistaken. May I seek clarity on whether there security warning is valid, and if yes, how should the code be amended?

[aarondl]

It is enough. We don't do string building with those. This seems to be a false positive? Can you look more into what whatever vulnerability scanner you're using is reporting and why it would think this?

[elfgoh]

Thanks, it seems like the scanner was unstable. Subsequent scans cleared the original trigger. Will definitely report upstream if it happens again