3 ms·

The updated SqlQuery function of .NET 8 is pretty cool. It takes a string but safely interpolates the parameters. https://learn.microsoft.com/en-us/ef/core/wha

The updated SqlQuery function of .NET 8 is pretty cool. It takes a string but safely interpolates the parameters. https://learn.microsoft.com/en-us/ef/core/what-is-new/ef-core-8.0/whatsnew https://learn.microsoft.com/en-us/ef/core/what-is-new/ef-cor... https://timdeschryver.dev/blog/you-can-now-return-unmapped-types-from-raw-sql-select-statements-with-entity-framework-8 https://timdeschryver.dev/blog/you-can-now-return-unmapped-t... "With the new SqlQuery method, you can now write your own SQL queries and map the result to any type that you want. This is useful for tasks that are not directly related to the day-to-day business of your application. For example, this can be used to import data, migrate data, or to retrieve data from a legacy system."

throwaway2990 3y ago
Sooo it’s dapper with string interpolation override to make queries parameterized so you don’t need to manually put the parameters on as 2nd arguments?
- intrasight 3y ago
  It's not just interpolation. The interpolation handler rewrites the query and makes it safe from SQL injection. There's an add-on to Dapper that does similar: https://github.com/mishael-o/Dapper.SimpleSqlBuilder https://github.com/mishael-o/Dapper.SimpleSqlBuilder
- useerup 3y ago
  > Sooo it’s dapper with string interpolation override to make queries parameterized so you don’t need to manually put the parameters on as 2nd arguments? Pretty much. C# does some really cool innovations around string interpolation which proves very useful for logging, SQL query etc. You can create your own string interpolation handler, which is what the new SQL query does and what several log libraries do. So basically you can use interpolation safely and remain assured that you do not introduce SQL injection errors. Also, this way string interpolation does not prevent query plan caching, as normal string interpolation would do.

throwaway2990 3y ago

Sooo it’s dapper with string interpolation override to make queries parameterized so you don’t need to manually put the parameters on as 2nd arguments?

intrasight 3y ago
It's not just interpolation. The interpolation handler rewrites the query and makes it safe from SQL injection. There's an add-on to Dapper that does similar: https://github.com/mishael-o/Dapper.SimpleSqlBuilder https://github.com/mishael-o/Dapper.SimpleSqlBuilder
useerup 3y ago
> Sooo it’s dapper with string interpolation override to make queries parameterized so you don’t need to manually put the parameters on as 2nd arguments? Pretty much. C# does some really cool innovations around string interpolation which proves very useful for logging, SQL query etc. You can create your own string interpolation handler, which is what the new SQL query does and what several log libraries do. So basically you can use interpolation safely and remain assured that you do not introduce SQL injection errors. Also, this way string interpolation does not prevent query plan caching, as normal string interpolation would do.