C# safely build an SQL string to execute using Entity Framework

Question

I'm executing some SQL using EF with the .SqlQuery(string sql) command.

I want to make sure my sql string is completely sanitised, so the logic approach was to use an SqlCommand object with parameters to build it.

However I don't want to execute it using the SqlCommand, I just want the SqlCommand to spit out a string that I can plug into my EF .SqlQuery(...) call.

Is there a way of doing this, or another method of ensuring my .SqlQuery won't result in injection?

Answer 1

Doesn't EF support that out of the box?

You should be able to call SqlQuery with parameters, so it will take care of SQL injection etc., just like SqlCommand does:

var tests = context.Database.SqlQuery<Test>(
    @"SELECT Id, Name FROM tests where Name={0}", "TestName");

or..

var tests = context.Database.SqlQuery<Test>(
    @"SELECT Id, Name FROM tests where Name=@name", 
    new SqlParameter("@name", "TestName"));