ASP.NET Monsters #105: SQL Injection attacks in Entity Framework Core 2.0
TTS
Entity Framework Core 2 was released recently. In today's episode we explore a new feature which automatically paramaterizes SQL Queries when the FromSql method is used with an interpolated string. Monster Dave shows us exactly why parametrized queries are so important when querying using raw sql.
Episode Sponsor:
AppVeyor - Continuous Delivery Services for Windows Developers - https://www.appveyor.com/
Related Links:
EF Core 2 Announcement --
https://blogs.msdn.microsoft.com/dotnet/2017/08/14/announcing-entity-framework-core-2-0/
EF Core Injection Samples by Nick Craver - https://github.com/NickCraver/EFCoreInjectionSample/blob/master/Program.cs
FormattableString - MSDN - https://msdn.microsoft.com/en-us/library/system.formattablestring(v=vs.110).aspx
2017-09-02 15:00:01
source
Gloss