liveBook · Manning

Parameterized query

As explained in ASP.NET Core in Action, 3e

A parameterized query separates user-supplied values from the SQL command structure so the values are not interpreted as SQL code.

A parameterized query keeps user-supplied values separate from the SQL command structure. This prevents input from being interpreted as SQL code and blocks SQL injection attacks. section 29.4.2

Use parameterization whenever application input becomes part of a database request:

  • Avoid building SQL with string concatenation, even when the input appears harmless. section 29.4.2
  • Use standard LINQ queries with EF Core when possible; EF Core creates parameterized SQL automatically. section 29.4.2
  • Apply the same principle to low-level ADO.NET and to NoSQL or document databases that provide an equivalent mechanism. section 29.4.2

Separating a search value from SQL

In EF Core, a placeholder keeps the search value separate from the SQL command: `FromSqlRaw("SELECT * FROM Recipes WHERE Name = '{0}'", search)`. An attempted value such as `'; DROP TABLE Recipes; --` is treated as input rather than executable SQL. section 29.4.2

How ASP.NET Core in Action, 3e covers it

How deep it goes
Explains the security principle and demonstrates placeholder-based EF Core usage, without detailing driver-level parameter binding internals.
Examples
Uses an EF Core recipe search, unsafe string concatenation, a malicious DROP TABLE value, and a placeholder-based correction.
What you can do after
Apply it via EF Core or ADO.NET when writing database queries that include user input.
How it connects
Connects SQL injection with EF Core, LINQ, ORM usage, ADO.NET, and raw SQL queries.
Cover of ASP.NET Core in Action, 3e
liveBookmanning.com
Read ASP.NET Core in Action, 3e on liveBook Get the book at manning.com

Also explained in

Compare how 8 books explain parameterized query →

Related concepts

This explainer was generated by Manning's knowledge graph from the text of ASP.NET Core in Action, 3e. The section links point to the parts of the book it draws on.