Preventing SQL injection in C# with Entity Framework

The page says SQL injection happens when attackers manipulate SQL queries through user input, which can expose sensitive data, corrupt data, or give control over the database server. It contrasts unsafe string concatenation with parameterized queries and says escaping is error-prone, while prepared statements keep input as data.

Reading notes

#

• SQL injection is described as one of the most severe web application security vulnerabilities.
• String concatenation can let user input change the execution path of a query.
• Characters such as ; and -- can terminate a query early and turn the rest into comments.
• Prepared statements separate the SQL structure from the parameters, so the database treats the parameters as data.
• Entity Framework can reduce SQL injection risk through LINQ, FromSqlInterpolated, and FromSqlRaw with explicit parameters.
• LINQ is presented as the recommended default for most queries in EF.
• LINQ is converted by Entity Framework into SQL using prepared statements and parameterization.
• LINQ can be less efficient for complex queries and may not express some SQL features easily.
• FromSqlInterpolated is presented as a safe way to run raw SQL because EF parameterizes the interpolated values.
• FromSqlRaw can be safe when explicit parameters are used, but unsafe use is easy to miss.
• The page recommends Snyk Code to detect unsafe code construction in C#.
• The advice is to use LINQ by default, use FromSqlInterpolated for complex SQL, and avoid FromSqlRaw when possible.