Raw sql without parameters (ARCH208)

Key dotnet.ef.raw-sql-without-parameters · Severity error · Category ef

Concatenating user input into SQL text creates a SQL injection vulnerability.

Incorrect

var users = await _db.Users
    .FromSqlRaw("SELECT * FROM Users WHERE Name = '" + name + "'")
    .ToListAsync();

Correct

var users = await _db.Users
    .FromSql($"SELECT * FROM Users WHERE Name = {name}")
    .ToListAsync();

Fix

Use interpolated FromSql or explicit parameters; never concatenate values into the string.