Blog

Mert Özen's blog posts on software development, backend, frontend, and DevOps.

Series

.NET Core Web API 36 Angular 31 JavaScript Basics 19 JavaScript Intermediate 18 JavaScript Advanced 16 TypeScript Basics 14 TypeScript Intermediate 14 TypeScript Advanced 12 Entity Framework Core 28 Dapper 16

2 posts found #sql-injection

Newest Oldest Popular

Database PART 04

Parameters and SQL Injection with Dapper: The Rules of a Safe Query

We see with a real attack why string concatenation opens the door to SQL injection, then look at anonymous objects, DynamicParameters, IN @Ids list expansion, DbString and the $ prefix, along with silent traps such as ORDER BY @Column.

6 Nov 2026 10 min 4

Database PART 14

Dynamic SQL with Dapper: SqlBuilder, Safe Filters and Contrib, Dommel, Dapper Plus

Building optional filters without string concatenation: Dapper.SqlBuilder's templates and placeholders, count and page queries from one builder, safe sorting with a whitelist and the OrWhere surprise. Then a balanced look at Dapper.Contrib, Rainbow, Dommel and the commercial Dapper Plus as of November 2026.

6 Nov 2026 10 min 4