Updat erubhan besar query builder

internal/utils/query/builder.go

@@ -472,9 +472,9 @@ func (qb *QueryBuilder) BuildQuery(query DynamicQuery) (string, []interface{}, e
 
 	finalSQL := strings.Join(queryParts, " ")
 
-	// Security check for dangerous patterns
+	// Security check for dangerous patterns in user input values
 	if qb.enableSecurityChecks {
-		if err := qb.checkForSqlInjection(finalSQL); err != nil {
+		if err := qb.checkForSqlInjectionInArgs(allArgs); err != nil {
 			return "", nil, err
 		}
 	}
@@ -1327,16 +1327,20 @@ func (qb *QueryBuilder) escapeIdentifier(col string) string {
 	}
 }
 
-// checkForSqlInjection checks for potential SQL injection patterns
-func (qb *QueryBuilder) checkForSqlInjection(sql string) error {
+// checkForSqlInjectionInArgs checks for potential SQL injection patterns in query arguments
+func (qb *QueryBuilder) checkForSqlInjectionInArgs(args []interface{}) error {
 	if !qb.enableSecurityChecks {
 		return nil
 	}
 
-	lowerSQL := strings.ToLower(sql)
-	for _, pattern := range qb.dangerousPatterns {
-		if pattern.MatchString(lowerSQL) {
-			return fmt.Errorf("potential SQL injection detected: pattern %s matched", pattern.String())
+	for _, arg := range args {
+		if str, ok := arg.(string); ok {
+			lowerStr := strings.ToLower(str)
+			for _, pattern := range qb.dangerousPatterns {
+				if pattern.MatchString(lowerStr) {
+					return fmt.Errorf("potential SQL injection detected in query argument: pattern %s matched", pattern.String())
+				}
+			}
 		}
 	}
 	return nil