> All you need is for one silly person to assign the C# query to a `var` beforehand and then the behavior's wrong. That would cause a compilation error. `DbSet

> All you need is for one silly person to assign the C# query to a `var` beforehand and then the behavior's wrong. That would cause a compilation error. `DbSet<TEntity>.FromSql(FormattableString sql)` [0] does not have a string overload. Therefore, if a user assigned the interpolated string to a SQL query to a `var` beforehand, then there would be an implicit conversion to a `string` [1] which will be a type mismatch for the `FromSql` call. The user would have to assign the interpolated string to a `FormattableString` instead of `var` for the program to compile. There is also no implicit conversion for a `string` to a `FormattableString`. There is a `DbSet<TEntity>.FromSqlRaw(string sql, params object[] parameters)` [2] method that explicitly documents that it is vulnerable to SQL injection. > You-the-user can make C#'s safe, you-the-library-developer can make Java's safe. You-the-library-developer can make C# safe. [0] https://learn.microsoft.com/en-us/dotnet/api/microsoft.entityframeworkcore.relationalqueryableextensions.fromsql?view=efcore-7.0 https://learn.microsoft.com/en-us/dotnet/api/microsoft.entit... [1] https://learn.microsoft.com/en-us/dotnet/csharp/language-reference/tokens/interpolated#implicit-conversions-and-how-to-specify-iformatprovider-implementation https://learn.microsoft.com/en-us/dotnet/csharp/language-ref... [2] https://learn.microsoft.com/en-us/dotnet/api/microsoft.entityframeworkcore.relationalqueryableextensions.fromsqlraw?view=efcore-7.0 https://learn.microsoft.com/en-us/dotnet/api/microsoft.entit...