Fix false negative for SQL injection when using DB.QueryRow.Scan()

[kaiili]

Problem

fixes #713

Details :

can be seen in #713.
G201 regexp only match callexpr once.
If there is a sqlquery like the following, there will be problems with matching.

func main() {
	var name string
	db, err := sql.Open("sqlite3", ":memory:")
	if err != nil {
		panic(err)
	}
	q := fmt.Sprintf("SELECT name FROM users where id = '%s'", os.Args[1])
	err = db.QueryRow(q).Scan(&name)
	if err != nil {
		panic(err)
	}
	defer db.Close()
}

Solution

Add an extra check befor checkQuery.

[ccojocar]

@kaiili Can you please rebase? Thanks

[kaiili]

I rebase my fork repo , and pull request on #759 for wasting some time with this pr, as I'm not very proficient with git.