--- title: Prevent SQL Injection in .NET | daily.dev description: SQL injection remains a common vulnerability caused by building queries with unsanitized user input rather than parameterizing them. The piece walks through... canonical: https://daily.dev/posts/prevent-sql-injection-in-net-gplzvnumk twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Prevent SQL Injection in .NET | daily.dev og:description: SQL injection remains a common vulnerability caused by building queries with unsanitized user input rather than parameterizing them. The piece walks through... og:url: https://daily.dev/posts/prevent-sql-injection-in-net-gplzvnumk og:image: https://api.daily.dev/og/posts/gPlzvNUMK.png og:image:alt: Prevent SQL Injection in .NET og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Prevent SQL Injection in .NET **[NikolaTech](https://daily.dev/sources/nikolatech)** · 3 min read · 0 upvotes · 0 comments ## Summary SQL injection remains a common vulnerability caused by building queries with unsanitized user input rather than parameterizing them. The piece walks through how an attacker can exploit string-concatenated queries to bypass filters or delete data, then shows how EF Core's LINQ translates queries into parameterized SQL automatically, and how FromSqlRaw with placeholders keeps raw SQL safe. For Dapper, where SQL is written manually, named parameters passed via an anonymous object prevent injection for selects, inserts, updates, and stored procedures. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How do I prevent SQL injection when using Dapper in .NET? Use named parameters in the SQL string and pass values through a separate anonymous object instead of concatenating strings. For example, write a query with "WHERE SerialNumber = @SerialNumber" and call QueryFirstOrDefaultAsync with a second argument like new { SerialNumber = serialNumber }. Dapper maps the parameter and sends it separately from the SQL text, so user input is never embedded in the command. The same approach applies to inserts, updates, and stored procedures. _Developers hardening data access layers track Dapper and EF Core security patterns like this on daily.dev._ ### Does using LINQ in EF Core protect against SQL injection? Yes, LINQ queries in EF Core are automatically translated into parameterized SQL, so user input like a serial number is sent as a SQL parameter (e.g., @__serialNumber_0) rather than embedded directly in the query text. This holds even when the value originates from user input. For raw SQL scenarios, FromSqlRaw with placeholders such as {0} achieves the same parameterization instead of string concatenation. _Teams choosing between ORMs and raw SQL weigh safety trade-offs like these on daily.dev._ ## Similar posts on daily.dev - [How ORMs Still Let SQL Injection Through \(and How to Close the Gaps\)](https://daily.dev/posts/how-orms-still-let-sql-injection-through-and-how-to-close-the-gaps--uwxttxmz8) · freeCodeCamp · 67 upvotes · 2 comments - [SQL Injection: Why It Persists and How to Prevent It](https://daily.dev/posts/sql-injection-why-it-persists-and-how-to-prevent-it-a5i6fyqpz) · Latest Hacking News · 0 upvotes · 0 comments - [How C\# Strings Silently Kill Your SQL Server Indexes in Dapper](https://daily.dev/posts/how-c-strings-silently-kill-your-sql-server-indexes-in-dapper-ubixcltoi) · Hacker News · 0 upvotes · 0 comments - [6 EF Core Query Mistakes That Get Expensive in Production](https://daily.dev/posts/6-ef-core-query-mistakes-that-get-expensive-in-production-5cpkulovz) · Waseem .NET Newsletter · 9 upvotes · 0 comments - [Stored Procedures with Entity Framework Core in .NET](https://daily.dev/posts/stored-procedures-with-entity-framework-core-in-net-h5rtelyst) · We Are .NET · 9 upvotes · 0 comments --- Tags: [#sql](https://daily.dev/tags/sql), [#c#](https://daily.dev/tags/c#), [#appsec](https://daily.dev/tags/appsec) [View this post on daily.dev](https://daily.dev/posts/prevent-sql-injection-in-net-gplzvnumk) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Prevent SQL Injection in .NET","url":"https://daily.dev/posts/prevent-sql-injection-in-net-gplzvnumk","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/prevent-sql-injection-in-net-gplzvnumk"},"datePublished":"2026-10-04T13:05:49.238Z","dateModified":"2026-10-04T13:12:15.140Z","description":"SQL injection remains a common vulnerability caused by building queries with unsanitized user input rather than parameterizing them. The piece walks through...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/1ae1252cd9c4f7d7f8493872f29e7bd3?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/1ae1252cd9c4f7d7f8493872f29e7bd3?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"NikolaTech","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"NikolaTech","logo":"https://media.daily.dev/image/upload/s--1h2fO6FL--/f_auto,q_auto/v1791119050/logos/nikolatech?_a=BAMAMicg0","url":"https://daily.dev/sources/nikolatech"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/prevent-sql-injection-in-net-gplzvnumk","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"sql,c#,appsec","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"NikolaTech","item":"https://daily.dev/sources/nikolatech"},{"@type":"ListItem","position":3,"name":"Prevent SQL Injection in .NET"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/prevent-sql-injection-in-net-gplzvnumk#faq","mainEntity":[{"@type":"Question","name":"How do I prevent SQL injection when using Dapper in .NET?","acceptedAnswer":{"@type":"Answer","text":"Use named parameters in the SQL string and pass values through a separate anonymous object instead of concatenating strings. For example, write a query with \"WHERE SerialNumber = @SerialNumber\" and call QueryFirstOrDefaultAsync with a second argument like new { SerialNumber = serialNumber }. Dapper maps the parameter and sends it separately from the SQL text, so user input is never embedded in the command. The same approach applies to inserts, updates, and stored procedures. Developers hardening data access layers track Dapper and EF Core security patterns like this on daily.dev."}},{"@type":"Question","name":"Does using LINQ in EF Core protect against SQL injection?","acceptedAnswer":{"@type":"Answer","text":"Yes, LINQ queries in EF Core are automatically translated into parameterized SQL, so user input like a serial number is sent as a SQL parameter (e.g., @__serialNumber_0) rather than embedded directly in the query text. This holds even when the value originates from user input. For raw SQL scenarios, FromSqlRaw with placeholders such as {0} achieves the same parameterization instead of string concatenation. Teams choosing between ORMs and raw SQL weigh safety trade-offs like these on daily.dev."}}]} ```