I prefer the MafiaCIA angle . They had motive , they had means , and they were some ruthless motherfuckers . <| sep |> Default are parameterized queries . You get some kind of security out of the box . But PHP has parameterized queries as well . Don ' t know if it ' s just via PDO , but it has them . Since you find tons of crap PHP code on the web , I guess close to no example would ever show that . $ var m ysqlsuperrealescapestring $ input m y s q lwhateverisnewqueryINSERT INTO bla col VALUES $ varMost 99 % of examples would do the above which is not a good idea . Better hand it to the driverdatabase what to do with the input . The databasesql package gives you sane defaults , like connection pooling and parameterized queries . EDIT If I see that correctly , one could execute JS on a target machine and one could upload a 1 GB url to have some , uh , fun . I ' ll test that and edit with my results . EDIT 2 When I get throttled by your app and start to post a huge URL , it works , so one could easily OOM your app . EDIT 3 Following code works quick dirty S . And I chose 1 GiB on purpose . Your PostgreSQL takes 1 GB of text in a text field . Let ' s see how it goes . package main import net mathrand ioioutil fmt neturl const chars a b c d efghijklmnopqrstuvwxyztel header url URLStart func main c , err net . Dialtcp , r 8 r . org 80 if err ! nil panicerr defer c . Close checkErrorc . WritebytePOST generate HTTP 1 . 1 rn checkErrorc . WritebyteHost r 8 r . orgrn checkErrorc . WritebyteContentType a p p l i c ationxwwwformurlencodedrn checkErrorfmt . Fprintfc , ContentLength % drnrn , 1 30 checkErrorc . Writebyteheader lastMB 0 currentMB 0 checkErrorfmt . Fprintfc , url . QueryEscapeURLStart fmt . PrintlnSending payload for i 0 i 1 30 lenURLStart i checkErrorc . Writebytecharsrand . Intnlenchars currentMB i 1024 1024 if currentMB ! lastMB lastMB currentMB fmt . PrintfSent % dMiB datan , i 1024 1024 checkErrorc . Writebytern b , err ioutil . ReadAllc if err ! nil panicerr fmt . Printlnstringb func checkErrorn int , err error if err ! nil panicerr EDIT 4 Ok , it ' s possible to upload 1 GB link . But the JS thingy doesn ' t work at least in Chrome , maybe IE will do it . My advice would be to use a limit reader and a timeout in the generate handler . With these in place a DDoS isn ' t that easy anymore . Haven ' t tested more cause I need to get back to work . EDIT 5 I forgot something . You should check for throttling before you parse the form .