The sql package in the standard library has support for parameterized queries, so you should use those instead of some random function to check for injections.