diff --git a/internal/sanitize/sanitize.go b/internal/sanitize/sanitize.go index e9e6d228..f9091cd4 100644 --- a/internal/sanitize/sanitize.go +++ b/internal/sanitize/sanitize.go @@ -35,6 +35,11 @@ func (q *Query) Sanitize(args ...any) (string, error) { str = part case int: argIdx := part - 1 + + if argIdx < 0 { + return "", fmt.Errorf("first sql argument must be > 0") + } + if argIdx >= len(args) { return "", fmt.Errorf("insufficient arguments") }