Blog
Mert Özen's blog posts on software development, backend, frontend, and DevOps.
Parameters and SQL Injection with Dapper: The Rules of a Safe Query
We see with a real attack why string concatenation opens the door to SQL injection, then look at anonymous objects, DynamicParameters, IN @Ids list expansion, DbString and the $ prefix, along with silent traps such as ORDER BY @Column.
Single-Row Queries with Dapper: QueryFirst, QuerySingle and ExecuteScalar
We run QueryFirst, QueryFirstOrDefault, QuerySingle and QuerySingleOrDefault side by side with zero, one and many rows to see which exception each throws and when, along with the pitfalls of default(T), nullable types and ExecuteScalar<T>.
Query and Mapping with Dapper: How Do Columns Map to Properties?
We look at how Query<T> maps columns to properties: case-insensitive matching, silently skipped columns, NULL and default values, MatchNamesWithUnderscores and its cache trap, dynamic results and constructor mapping for records.
What Is Dapper? The Thin Layer on Top of ADO.NET and Your First Query
We meet Dapper as a set of extension methods on top of ADO.NET: what micro-ORM means, when to pick it over EF Core, setting up .NET 10 + Dapper 2.1.89 + SQLite, the first Query and a short history from 1.x to Dapper.AOT.
What's New in EF Core 10: Named Query Filters, LeftJoin and Complex Types in JSON
Named query filters and IgnoreQueryFilters(["..."]), LeftJoin/RightJoin, ExecuteUpdateAsync with a regular lambda, complex types and ComplexCollection mapped to JSON, padded parameterized collections, vector search with SqlVector and the SQLite DateTimeOffset breaking change in EF Core 10 LTS.
What's New in EF Core 9: UseSeeding, Migration Locking and PendingModelChangesWarning
PendingModelChangesWarning catching a missing migration at Migrate time, the HasData and DateTime.Now trap, UseSeeding/UseAsyncSeeding, migration locking with __EFMigrationsLock, auto-discovered compiled models and EFOptimizeContext, and ExecuteUpdate with complex types in EF Core 9.
What's New in EF Core 8: Complex Types, Primitive Collections and SqlQuery<T>
Primitive collections and json_each, ComplexProperty for value objects, SqlQuery<T> for non-entity types, no-tracking lazy loading, JSON on SQLite and HierarchyId in EF Core 8 LTS, plus Contains moving to OPENJSON and UseCompatibilityLevel(120).
What's New in EF Core 7: ExecuteUpdate, ExecuteDelete, JSON Columns and TPC
ExecuteUpdate/ExecuteDelete, ToJson for owned types in JSON columns, TPC inheritance, IMaterializationInterceptor, FromSql and SqlQuery<int> in EF Core 7, plus moving from EF Core 6 with breaking changes like Encrypt=True and HasTrigger.
Legacy Projects: Moving from EF Core 3.1 and EF Core 5 to EF Core 6
The end of client evaluation in EF Core 3.0, FromSql split into FromSqlRaw/FromSqlInterpolated, many-to-many, filtered include and split queries in EF Core 5, how Nullable affects migrations when moving to EF Core 6, and support status.
EF Core and Architecture: Repositories, the Read Side of CQRS and Moving to Dapper
With real SQL we see how a generic repository silently moves the WHERE into memory, and discuss DbContext already being a unit of work. We finish the core block with an aggregate-specific repository, projections on the CQRS read side and Dapper sharing the same connection and transaction.
Testing with EF Core: SQLite In-Memory and InMemory Provider Pitfalls
With real test output we see how the InMemory provider silently lets unique indexes, foreign keys and raw SQL slip through, and build realistic tests with SQLite in-memory. We cover the false green of asserting on the same context and the debate about abstracting DbContext, using the EF documentation's guidance.
EF Core Interceptors and Events: Audit Fields and Slow Query Logging
We fill CreatedAt and UpdatedAt automatically with a SaveChangesInterceptor, log queries over a threshold with a DbCommandInterceptor, and watch the change tracker live through SavingChanges and StateChanged events. We also see why nothing runs when you forget the async override.