Raw Query Builder

When the fluent query builder or model APIs are insufficient, use raw SQL. GORM's Raw and Exec handle parameterized queries to prevent SQL injection.

Overview

Nimbus exposes GORM's database connection via database.Get(). Use Raw for SELECT and Exec for INSERT/UPDATE/DELETE.

Raw SELECT

db := database.Get()

// Parameterized query (use ? for placeholders)
var count int64
db.Raw("SELECT COUNT(*) FROM posts WHERE status = ?", "published").Scan(&count)

// Multiple rows
var posts []Post
db.Raw("SELECT * FROM posts WHERE created_at > ?", time.Now().AddDate(0, 0, -7)).Scan(&posts)

Raw Exec

For INSERT, UPDATE, DELETE use Exec.

db.Exec("UPDATE posts SET status = ? WHERE id = ?", "published", 1)
db.Exec("DELETE FROM posts WHERE status = ? AND created_at < ?", "draft", cutoff)

Named arguments

GORM supports named parameters with @name or sql.Named.

db.Raw("SELECT * FROM posts WHERE status = @status", sql.Named("status", "published")).Scan(&posts)

Raw with subquery

db.Raw(`
    SELECT * FROM posts
    WHERE user_id IN (SELECT id FROM users WHERE role = ?)
`, "admin").Scan(&posts)

Security

Always use parameterized queries. Never concatenate user input into SQL strings.

// BAD: SQL injection risk
db.Raw("SELECT * FROM posts WHERE title = '" + userInput + "'")

// GOOD: parameterized
db.Raw("SELECT * FROM posts WHERE title = ?", userInput)