code: func NewSQLStrFormat(id string, conf gosec.Config) (gosec.Rule, []ast.Node) {
  	rule := &sqlStrFormat{
  		calls:         gosec.NewCallList(),
  		noIssue:       gosec.NewCallList(),
  		noIssueQuoted: gosec.NewCallList(),
  		sqlStatement: sqlStatement{
  			patterns: []*regexp.Regexp{
  				regexp.MustCompile("(?)(SELECT|DELETE|INSERT|UPDATE|INTO|FROM|WHERE) "),
  				regexp.MustCompile("%[^bdoxXfFp]"),
  			},
  			MetaData: gosec.MetaData{
  				ID:         id,
  				Severity:   gosec.Medium,
  				Confidence: gosec.High,
  				What:       "SQL string formatting",
  			},
  		},
  	}
  	rule.calls.AddAll("fmt", "Sprint", "Sprintf", "Sprintln", "Fprintf")
  	rule.noIssue.AddAll("os", "Stdout", "Stderr")
  	rule.noIssueQuoted.Add("github.com/lib/pq", "QuoteIdentifier")
  	return rule, []ast.Node{(*ast.CallExpr)(nil)}
  }
docs: // NewSQLStrFormat looks for cases where we're building SQL query strings using format strings