Prepared statement

login := "admin"
password := "' OR login = 'admin"

stmt, err := db.Prepare("SELECT * FROM users WHERE login = ? AND password = ?")
if err != nil {
    log.Fatal(err)
}
res, err := stmt.Exec(login, password)