Entity Framework Core Interview Question #139

What is the difference between parameterized raw SQL and unsafe SQL string construction?

Performance, Raw SQL, Stored Procedures & Advanced Queries Senior Advanced

Quick Interview Answer

Parameterized SQL sends values separately from command structure, helping prevent SQL injection and allowing values to be treated as data. Concatenating untrusted input directly into SQL can let an attacker change command meaning. Use EF Core APIs that parameterize values and never build SQL by concatenating untrusted input.

Detailed Explanation

Parameterized SQL sends values separately from command structure, helping prevent SQL injection and allowing values to be treated as data. Concatenating untrusted input directly into SQL can let an attacker change command meaning. Use EF Core APIs that parameterize values and never build SQL by concatenating untrusted input.

Code Example

var products = await db.Products
    .FromSql($"SELECT * FROM Products WHERE Name = {name}")
    .ToListAsync();

// Do not concatenate untrusted input into SQL.