dotnet / dotnet/EntityFramework.Docs
Raw SQL parameter analyzer
- Dominant language
- Mermaid
- Stars
- 1.7k
- Forks
- 2k
- Avg merge
- 7d 23h
- Merged PRs (30d)
- 16
Description
This is a pretty subtle detail if you are not paying attention and do not already understand how FormattableStrings become strings unless you are explicit about maintaining the FormattableString type. It seems like providing an example of correct usage or elaborating on incorrect usage would help, as could linking to related documentation.
For example:
// UNSAFE: In this case `sql` is implicitly cast to a plain old `string` and which results in `FormSql` not being able to parameterize `minAge`.
var sql = $"SELECT * FROM People WHERE Age > {minAge}";
var query = context.People.FromSql(sql);
// SAFE: By explicitly declaring that `sql` as a `FormattableString`, `FromSql` will be able to parameterize `minAge`.
FormattableString sql = $"SELECT * FROM People WHERE Age > {minAge}";
var query = context.People.FromSql(sql);
Even more subtle is a formattable string that is composed of formattable strings may not result in parameterization like one might assume. Frankly it would be nice to enable throwing instead of only logging on potentially unsafe queries, but that's an issue for another day.
Related documentation: https://docs.microsoft.com/en-us/ef/core/querying/raw-sql#passing-parameters
---
#### Document Details
⚠ *Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.*
* ID: 05d786fb-de7d-de13-7989-c29bfb990e4f
* Version Independent ID: 2f981058-e284-cb85-574c-a2cade3f2174
* Content: [What is new in EF Core 2.1 - EF Core](https://docs.microsoft.com/en-us/ef/core/what-is-new/ef-core-2.1)
* Content Source: [entity-framework/core/what-is-new/ef-core-2.1.md](https://github.com/aspnet/EntityFramework.Docs/blob/master/entity-framework/core/what-is-new/ef-core-2.1.md)
* Product: **entity-framework**
* GitHub Login: @divega
* Microsoft Alias: **divega**
Contributor guide
Assessment
This issue has not been assessed yet.