[source, go]

  ----

  name := r.FormValue("name")

  template := template.Must(template.ParseGlob("xss.html"))

  data["Name"] = name

  err := template.ExecuteTemplate(w, name, data)

  ----

  === 4. Protect yourself from SQL injections

  [source, go]

  ----

  customerName := r.URL.Query().Get("name")

  db.Exec("UPDATE creditcards SET name=? WHERE customerId=?", customerName, 233, 90)

  ----

  If using the db.Query() function instead, ensure you sanitize the user’s input first, as above. 

  [source, go]

  ----

  w.Header().Add("Strict-Transport-Security", "max-age=63072000; includeSubDomains")

  ----

  You might also want to specify the server name in the TLS configuration, like this:

  [source, go]

  ----

  config := &tls.Config{ServerName: "yourSiteOrServiceName"}

  ----

  Of Note: It’s always a good practice to implement in-transit encryption even if your application is only for internal communication. Imagine if, for some reason, an attacker could sniff your internal traffic. Whenever you can, it’s  always best to raise the difficulty bar for possible future attackers.

  Go doesn’t have exceptions. This means that you’d need to handle errors differently than with other languages. The standard looks like this:

  [source, go]

  ----

  if err != nil {

      // handle the error

  }

  ----

  Also, Go offers a native library to work with logs. The most simple code is like this:

  [source, go]

  ----

  package main

  import (

  func main() {

  	log.Print("Logging in Go!")

  }

  ----

  ==== Further Reading

  * https://owasp.org/www-pdf-archive/Owasp-171123063052.pdf

  * https://github.com/securego/gosec

  * https://tutorialedge.net/golang/secure-coding-in-go-input-validation/