Entityframework.docs: Does this mean string interpolation syntax is safe?

[nicholasyin]

var user = "johndoe";
var blogs = context.Blogs
.FromSql($"EXECUTE dbo.GetMostPopularBlogsForUser {user}")
.ToList();

Is this protected from SQL injection attach?

---

Document Details

⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

• ID: 7e1289d5-8364-18a4-3445-6bba05c6854b
• Version Independent ID: 2680e647-f64a-7991-f821-3b5e2a845960
• Content: Raw SQL Queries - EF Core
• Content Source: entity-framework/core/querying/raw-sql.md
• Product: entity-framework
• GitHub Login: @rowanmiller
• Microsoft Alias: divega

[dalion619]

Yes. Source: https://docs.microsoft.com/en-us/ef/core/what-is-new/ef-core-2.0#string-interpolation-in-fromsql-and-executesqlcommand

[marekpetak]

So why VS I still shows a warning "The SQL expression passed to 'ExecuteSqlCommand' embeds data that will not be parameterized"?

[dalion619]

Multiple reasons to why VS would do that.

Maybe this can help with an explanation.
https://github.com/aspnet/EntityFrameworkCore/issues/10080

[ASKemp]

But concatenation, e.g.
_appDbContext
.Database
.ExecuteSqlCommand($"INSERT INTO tblclauditlog (tablename, fieldname, recordid) " +
$"VALUES ({tableName},{fieldName},{recordId})");

Is not?

Wish it was to enable tidier code.

[ronniedepriest]

NO NO NO, please PLEASE fix this documentation!!!! Interpolation results in injection vulnerability - the evaluation of the string interpolation is executed before the parameter is passed into the method call. The FormattableString is what is used in the example linked to from above, NOT interpolation!!!
See this page:
https://cmatskas.com/ef-core-string-interpolation-and-sql-injection/

I REPEAT in this document the example is using the FormattableString syntax, and calling is interpolation, BAD:
https://docs.microsoft.com/en-us/ef/core/what-is-new/ef-core-2.0#string-interpolation-in-fromsql-and-executesqlcommand
They are using the FormattableString syntax, NOT String interpolation:
var rawSql = $@"Select * from table where columnName = {varIn}";

[ghost]

@ronniedepriest from the links you gave, the only difference I can tell is the use of '$@' instead of '$'. Did you mean using '$@' will generate auto parameterization?

[kayjtea]

Both '$@' (verbatim string interpolation) and '$' produce FormattableString. The problem is operations on FormattableString can produce a string and the EFCore overload that takes
FormattableString won't be invoked, which is a pretty subtle way to introduce SQL injection bugs.

            var x = 1;
            FormattableString a = $"{x}"; // this compiles fine
            string  b = $"{x}"; // also compiles fine
            FormattableString c =  $"{x}".ToString(); // compilation error
            string d = a + a; // compilation error 
            string e = a + b; // compiles fine (ooops!)

[ajcvickers]

No longer relevant for 3.0.