LINQ to Entities, Entity SQL, Parameterized Store Queries and SQL Injection
Posted by: Julia Lerman Blog - Dont Be Iffy...,
on 08 Feb 2009 |
View original | Bookmarked: 0 time(s)
Last week, I was demoing some basic Entity Framework queries to a client and explaining
that the store queries are parameterized, alleviating one area of concern.
But when we looked at SQL Profiler the query was not parameterized. Why was this?
The query I had used was:
var query = from c in context.Customers where c.lastname=='Smith' select c;
I had hard coded the string for lastname into the query which resulted in the following
SQL:
SELECT TOP (1)
[Extent1].[CustomerID] AS [CustomerID],...