NM-258: passed as a bind parameter to statement.Exec(key) instead of being interpolated into the SQL string, which prevents SQL injection

database/sqlite.go

@@ -78,13 +78,13 @@ func sqliteInsertPeer(key string, value string) error {
 }
 
 func sqliteDeleteRecord(tableName string, key string) error {
-	deleteSQL := "DELETE FROM " + tableName + " WHERE key = \"" + key + "\""
+	deleteSQL := "DELETE FROM " + tableName + " WHERE key = ?"
 	statement, err := SqliteDB.Prepare(deleteSQL)
 	if err != nil {
 		return err
 	}
 	defer statement.Close()
-	if _, err = statement.Exec(); err != nil {
+	if _, err = statement.Exec(key); err != nil {
 		return err
 	}
 	return nil