Insertion using ExecuteSqlRaw() method with submitted form values in entity framework-CodePudding

Raw query insertion is working fine with hard codded values but I need to populate submitted form values in ExecuteSqlRaw() method.

 _context
.Database
.ExecuteSqlRaw("INSERT INTO Staff([StaffFirstName],[StaffLastName],[StaffPhoto], 
   [StaffDesignation],[StaffDepartment],[StaffBio]) 
   VALUES('1','2','3' ...)");

I tried interpolation syntax, but not working

CodePudding user response：

Why not use the built in addition function in Entity Framework? The way you are trying to insert the data opens the door for SQL Injection attacks

If you want to write sql to insert your data I would recommend dapper

_context.Staff.Add(staff)

CodePudding user response：

Technically to make it work as is, you just omitted the $""...

BUT, as @averybusinesssolutions says and as stated in the documentation:

never pass a concatenated or interpolated string ($"") with non-validated user-provided values

This exposes you to one of the most widespread attacks: the SQL injection attack.

Just read the doc and you will have the solution. Using:

ExecuteSqlRaw("INSERT INTO Staff(...) VALUE({0}...", StaffFirstName...);

instead of

ExecuteSqlRaw(@"INSERT INTO Staff(...) VALUE('{StaffFirstName}'...");

should work and will be safe against injections attacks.