Blog
Mert Özen's blog posts on software development, backend, frontend, and DevOps.
Series
.NET Core Web API
36
Angular
31
JavaScript Basics
19
JavaScript Intermediate
18
JavaScript Advanced
16
TypeScript Basics
14
TypeScript Intermediate
14
TypeScript Advanced
12
Entity Framework Core
28
Dapper
16
Git & GitHub
29
Web Security (OWASP Top 10)
21
LLM Fundamentals
20
C# Fundamentals
20
Object-Oriented Programming in C#
16
C# Collections and Generics
11
LINQ
17
Asynchronous Programming in C#
17
Advanced C#
14
C# Versions
6
Solution Patterns
22
2 posts found
#sql-injection
Database
PART 04
Parameters and SQL Injection with Dapper: The Rules of a Safe Query
We see with a real attack why string concatenation opens the door to SQL injection, then look at anonymous objects, DynamicParameters, IN @Ids list expansion, DbString and the $ prefix, along with silent traps such as ORDER BY @Column.
6 Nov 2026
10 min
12
Database
PART 14
Dynamic SQL with Dapper: SqlBuilder, Safe Filters and Contrib, Dommel, Dapper Plus
Building optional filters without string concatenation: Dapper.SqlBuilder's templates and placeholders, count and page queries from one builder, safe sorting with a whitelist and the OrWhere surprise. Then a balanced look at Dapper.Contrib, Rainbow, Dommel and the commercial Dapper Plus as of November 2026.
6 Nov 2026
10 min
14