SQL injection occurs when untrusted input changes a SQL statement’s structure or meaning. Building dynamic SQL through string interpolation increases this risk because input becomes part of the command itself. section 4.3.1
SQL parameters isolate values from SQL execution. ORMs such as EF Core can apply these protections automatically while generating the required database commands. section 4.3.1
Prefer these protections over ad hoc string handling:
- Use SQL parameters when writing dynamic SQL. section 4.3.1
- Use configured EF Core operations where appropriate; it generates SQL and applies anti-injection countermeasures. section 4.3.1
- Treat manual escaping and centralized helper workarounds cautiously because they can become outdated or insecure. section 4.3.1
var notes = "this user has been disabled";
// ... other code
$"UPDATE users SET notes = "{notes}" WHERE id = 4;";
Compare unsafe string interpolation with parameterized database commands. section 4.3.1
SqlDataAdapter myCommand = new SqlDataAdapter(
"UPDATE users SET notes = @notes", conn);
SQLParameter parm =
myCommand.SelectCommand.Parameters.Add("@notes",
SqlDbType.VarChar, 11);
Parm.Value = notes;
Inspect a parameterized update that keeps the value separate from the SQL command. section 4.3.1
