Squirrel (Go SQL query builder)
Fluent SQL query builder for Go that generates SQL queries programmatically without an ORM. Provides a chainable API for building SELECT, INSERT, UPDATE, and DELETE statements with safe parameter binding. Works with any sql.DB compatible database. The standard choice in Go when you want programmatic query construction without full ORM overhead — used extensively in Go microservices.
Score Breakdown
⚙ Agent Friendliness
🔒 Security
Parameterized queries prevent SQL injection by default. Archived library — no security patches; evaluate alternatives for new projects.
⚡ Reliability
Best When
You need dynamic SQL query construction in Go (conditional filters, varying columns) without raw string manipulation and without the overhead of a full ORM.
Avoid When
You want static SQL with compile-time verification (use sqlc) or full ORM features with migrations (use Ent or GORM).
Use Cases
- • Build dynamic SQL queries in Go with optional filters and conditions that vary at runtime without string concatenation
- • Construct complex multi-condition WHERE clauses programmatically using type-safe chainable Go API
- • Generate INSERT and UPDATE statements from Go structs without full ORM mapping and migrations
- • Batch insert operations with Squirrel's VALUES builder for efficient bulk data operations
- • Write repository pattern database access layers in Go with SQL control but without raw string assembly
Not For
- • Teams wanting entity relationships, migrations, and model definitions — use Ent or GORM for full ORM features
- • Compile-time SQL validation — Squirrel generates SQL at runtime; use sqlc for compile-time checked queries
- • Complex JOINs across many tables — Squirrel handles these but readability degrades with very complex queries
Interface
Authentication
Query builder library. Authentication via database connection string.
Pricing
Apache 2.0 license.
Agent Metadata
Known Gotchas
- ⚠ Squirrel uses PostgreSQL's $1, $2 placeholders by default — must configure sq.Dollar placeholder for PostgreSQL or sq.Question for MySQL/SQLite
- ⚠ ToSql() returns (string, []interface{}, error) — always check the error return even for simple queries; build errors are runtime not compile-time
- ⚠ Column names are not validated — typos in column names produce valid SQL that fails at the database level, not at build time
- ⚠ Squirrel does not handle NULL values automatically — must use sql.NullString, sql.NullInt64 etc. for nullable columns in Go structs
- ⚠ The StatementBuilderType cache (sq.StatementBuilder.PlaceholderFormat(...)) is not goroutine-safe if shared across goroutines — create per-request builders
- ⚠ Squirrel is archived/read-only as of 2023 — no new features; consider Jet or sq library forks for active maintenance
Alternatives
Full Evaluation Report
Detailed scoring breakdown, competitive positioning, security analysis, and improvement recommendations for Squirrel (Go SQL query builder).
Scores are editorial opinions as of 2026-03-06.