.NET Architecture & System Design Interview Question #168

How do parameterized queries help prevent SQL injection?

Security Architecture, Multi-Tenancy & Disaster Recovery Senior Advanced

Quick Interview Answer

Parameterized queries separate SQL command structure from user-supplied values. The database treats parameter values as data rather than executable SQL syntax.

Detailed Explanation

Parameterized queries separate SQL command structure from user-supplied values. The database treats parameter values as data rather than executable SQL syntax.

EF Core LINQ queries normally generate parameterized SQL for values. Raw SQL must be used carefully with parameterization; concatenating untrusted input into SQL text can create injection vulnerabilities.

Code Example

// Parameterized through LINQ
var user = await db.Users
    .SingleOrDefaultAsync(x => x.Email == email);

// Avoid building SQL by concatenating
// untrusted input.