Open-Source Databases · huandu

go-sqlbuilder

go-sqlbuilder is a lightweight Go library for programmatically constructing SQL statements without tying you to a specific database driver or ORM. It handles parameterized queries, supports multiple SQL dialects (MySQL, PostgreSQL, SQLite, HiveQL), and includes a minimal struct-based ORM for common CRUD operations.

Talk to DEV.co Discuss Implementation

Source: GitHub — github.com/huandu/go-sqlbuilder

1.7k

GitHub stars

140

Forks

Primary language

MIT

License (OSI-approved)

Key facts

Objective fields from the source. Values we can't verify are shown as “Unknown” rather than guessed.

Field	Value
Repository	huandu/go-sqlbuilder
Owner	huandu
Primary language	Go
License	MIT — OSI-approved
Stars	1.7k
Forks	140
Open issues	4
Latest release	v1.42.0 (2026-06-19)
Last updated	2026-06-21
Source	https://github.com/huandu/go-sqlbuilder

What go-sqlbuilder is

A driver-agnostic SQL builder for Go that generates parameterized SQL strings and argument slices compatible with database/sql. Provides typed builder APIs (SelectBuilder, InsertBuilder, UpdateBuilder, DeleteBuilder, UnionBuilder, CTEBuilder) plus a Struct reflection layer for ORM-like operations. Designed for performance and memory efficiency in high-volume transaction environments.

Quickstart

Get the go-sqlbuilder source

Clone the repository and explore it locally.

terminalbash

1git clone https://github.com/huandu/go-sqlbuilder.git2cd go-sqlbuilder3# follow the project's README for install & configuration

Need it deployed, integrated, or customized instead? DEV.co ships production installs.

Best use cases

Dynamic query construction in web services and APIs

When application logic must build queries conditionally based on filters, pagination, or search parameters, go-sqlbuilder ensures parameterized queries are generated safely without manual string concatenation.

Multi-dialect SQL generation

Organizations supporting multiple databases (PostgreSQL, MySQL, SQLite) can use a single builder API to generate dialect-appropriate SQL, reducing code duplication and maintenance burden.

Lightweight ORM alternative for data access layers

Teams wanting struct-based query and result mapping without the overhead of full-featured ORMs (like GORM or sqlc) can leverage the Struct factory and builder combination for typical CRUD workflows.

Implementation considerations

Parameterized queries are the default; always use Build() with args to avoid SQL injection when accepting user input.
The Struct reflection layer requires struct tags (db or json) to map columns; incorrect or missing tags will silently miss fields.
No connection pooling, transaction management, or error wrapping is provided; integrate with database/sql or a custom connection layer.
Raw() and SQL() methods bypass parameterization; use only for hardcoded, non-user-supplied SQL segments.
The library does not perform query optimization or execution planning; generated SQL quality depends on correct builder usage.

When to avoid it — and what to weigh

Complex relational queries with nested CTEs and multiple joins — While the library supports CTEs and nested joins, highly complex analytical queries may be clearer and less error-prone to write directly in SQL or via a more mature ORM with query optimization.
Need for automatic migration and schema management — go-sqlbuilder does not provide schema versioning, migration tooling, or automatic table creation. Teams requiring these features should pair it with separate migration tools or choose a full-featured ORM.
Requirement for SQL query validation before execution — The library generates syntactically correct SQL but does not validate against a live database schema or catch logical errors (e.g., invalid column names) until runtime execution.
Tight integration with specific ORMs or query loggers — If your project depends on hooks, query logging, or tight coupling to an existing ORM framework, go-sqlbuilder's minimalist design may require custom glue code.

License & commercial use

Released under the MIT License, a permissive OSI-approved license that permits unrestricted commercial and private use with minimal obligations.

MIT license permits commercial use without restriction. No commercial licensing terms, dual licensing, or proprietary restrictions are evident. Legal review of MIT terms is recommended per standard practice, but no barriers to commercial deployment exist.

DEV.co evaluation signals

Editorial assessment — not user reviews. Directional, with an explicit confidence level.

Signal	Assessment
Maintenance	Active
Documentation	Strong
License clarity	Clear
Deployment complexity	Low
DEV.co fit	Strong
Assessment confidence	High

Security considerations

Parameterized queries are the default behavior when using Build(), providing protection against SQL injection. Raw() and SQL() methods allow raw SQL insertion and bypass parameterization; use only for hardcoded or controlled input. No additional security features (e.g., query audit logging, encryption) are provided; implement at application layer if required.

Alternatives to consider

GORM

Full-featured ORM with migrations, hooks, advanced querying, and automatic relationship handling; heavier and more opinionated than go-sqlbuilder.

sqlc

Type-safe SQL code generation from hand-written SQL files; favors explicit SQL over builder APIs and requires a build step.

squirrel

Another lightweight Go SQL builder with similar builder API design; actively maintained but less enterprise-tested at scale than go-sqlbuilder.

Software development agency

Build on go-sqlbuilder with DEV.co software developers

go-sqlbuilder offers a lean, battle-tested alternative to heavyweight ORMs. Evaluate it for API backends, data layers, and multi-database applications.

Talk to DEV.co

Related open-source tools

Surfaced by semantic similarity across the DEV.co open-source index.

jet querybuilder bob

Related on DEV.co

Explore the category and the services that help you build with it.

Open-Source Databases API Development Custom Software Development Enterprise Software Talk to DEV.co

go-sqlbuilder FAQ

Is go-sqlbuilder an ORM?

It includes minimal ORM-like features (struct-based query/result mapping via Struct), but is primarily a SQL builder. Full ORMs (GORM, sqlc) provide richer abstractions. go-sqlbuilder is often used as a building block for custom data layers.

Does it protect against SQL injection?

Yes, when using Build() to generate parameterized queries. The returned args slice contains values, and the SQL string uses ? placeholders. Raw() and SQL() bypass parameterization and should only be used with trusted, hardcoded input.

Can it work with multiple databases?

Yes. The library is driver-agnostic and generates dialect-aware SQL (MySQL, PostgreSQL, SQLite, HiveQL). Generate the SQL once; execute against any compatible driver.

Does it support transactions?

No. go-sqlbuilder generates SQL strings only. Transactions must be managed via database/sql (*sql.Tx) or custom connection handling outside the library.

Work with a software development agency

Need help beyond evaluating go-sqlbuilder? DEV.co is a software development agency offering software development services and web development for teams of every size. Our software developers and web developers build custom software, web applications, APIs, and open-source databases integrations — and maintain them long-term.

Ready to streamline SQL generation in your Go services?

go-sqlbuilder offers a lean, battle-tested alternative to heavyweight ORMs. Evaluate it for API backends, data layers, and multi-database applications.

Talk to DEV.co Schedule a Consultation