dotnet / dotnet/EntityFramework.Docs

SqlQuery docs state to use parameter placeholders and supply additional parameters as arguments, but that's not the case for `.SqlQuery`

Open
#4,957 2 comments 0 reactions 0 assignees View on GitHub
Dominant language
Mermaid
Stars
1.7k
Forks
2k
Avg merge
7d 23h
Merged PRs (30d)
16

Description

### Type of issue

Outdated article

### Description

With current EFCore 9 (and I believe since 7?) the `.SqlQuery` method does not accept any arguments except for the query itself. I believe it's supposed to function like `.FromSql`, where interpolated strings are automatically parameterized, hence the existence of `.SqlQueryRaw`.

Either the documentation is outdated/incorrect, or this code is going to cause sql injection attacks to become more prevalent.

### Page URL

https://learn.microsoft.com/en-us/dotnet/api/microsoft.entityframeworkcore.relationaldatabasefacadeextensions.sqlquery?view=efcore-9.0

### Content source URL

https://github.com/dotnet/EntityFramework.ApiDocs/blob/live/dotnet/xml/Microsoft.EntityFrameworkCore/RelationalDatabaseFacadeExtensions.xml

### Document Version Independent Id

731055e2-2c41-b2bf-4d08-8d06cd1d6cc5

### Article author

@dotnet-bot

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.