dotnet / dotnet/EntityFramework.Docs
SqlQuery docs state to use parameter placeholders and supply additional parameters as arguments, but that's not the case for `.SqlQuery`
- Dominant language
- Mermaid
- Stars
- 1.7k
- Forks
- 2k
- Avg merge
- 7d 23h
- Merged PRs (30d)
- 16
Description
### Type of issue
Outdated article
### Description
With current EFCore 9 (and I believe since 7?) the `.SqlQuery` method does not accept any arguments except for the query itself. I believe it's supposed to function like `.FromSql`, where interpolated strings are automatically parameterized, hence the existence of `.SqlQueryRaw`.
Either the documentation is outdated/incorrect, or this code is going to cause sql injection attacks to become more prevalent.
### Page URL
https://learn.microsoft.com/en-us/dotnet/api/microsoft.entityframeworkcore.relationaldatabasefacadeextensions.sqlquery?view=efcore-9.0
### Content source URL
https://github.com/dotnet/EntityFramework.ApiDocs/blob/live/dotnet/xml/Microsoft.EntityFrameworkCore/RelationalDatabaseFacadeExtensions.xml
### Document Version Independent Id
731055e2-2c41-b2bf-4d08-8d06cd1d6cc5
### Article author
@dotnet-bot
Contributor guide
Assessment
This issue has not been assessed yet.