Blog
Mert Özen's blog posts on software development, backend, frontend, and DevOps.
OWASP A05: Injection (1) — SQL Injection and Command Injection
We write the same book search endpoint with string concatenation, an ADO.NET parameter, Dapper and EF Core, and see how a parameter turns ' OR 1=1 -- into plain data. We examine FromSqlRaw vs FromSql through the EF1002 warning and ToQueryString, use ArgumentList and an allowlist instead of a shell in Process.Start, and clarify where input validation fits with .NET 10's built-in validation.
Dynamic SQL with Dapper: SqlBuilder, Safe Filters and Contrib, Dommel, Dapper Plus
Building optional filters without string concatenation: Dapper.SqlBuilder's templates and placeholders, count and page queries from one builder, safe sorting with a whitelist and the OrWhere surprise. Then a balanced look at Dapper.Contrib, Rainbow, Dommel and the commercial Dapper Plus as of November 2026.
Parameters and SQL Injection with Dapper: The Rules of a Safe Query
We see with a real attack why string concatenation opens the door to SQL injection, then look at anonymous objects, DynamicParameters, IN @Ids list expansion, DbString and the $ prefix, along with silent traps such as ORDER BY @Column.
Raw SQL in EF Core: FromSqlRaw, FromSqlInterpolated, Keyless Entities and SQL Injection
We look at FromSqlRaw versus FromSqlInterpolated, the SQL produced when LINQ is composed on top, the SQL injection trap with $, ExecuteSql commands, keyless entities mapped to views, and calling stored procedures on SQL Server, all with real output.