C# EF Core FromSqlRaw SQL injection via string building
Rule ID: vetkit.csharp.sql-injection.ef-raw-sql-string-building
The SQL text passed to an EF Core Raw API (FromSqlRaw, ExecuteSqlRaw, SqlQueryRaw) is built with string interpolation, concatenation or string.Format. The Raw APIs run the text as-is, so any value spliced in changes the query (SQL injection); the interpolated overloads exist for exactly this case.
Last updated:
Suite: Security
csharp
The SQL text passed to an EF Core Raw API (FromSqlRaw, ExecuteSqlRaw, SqlQueryRaw) is built with string interpolation, concatenation or string.Format. The Raw APIs run the text as-is, so any value spliced in changes the query (SQL injection); the interpolated overloads exist for exactly this case.
Category: SECURITY · Engine rule severity: ERROR
How to fix it
Pass the interpolated string to FromSql / FromSqlInterpolated / ExecuteSqlInterpolated / SqlQuery, which turn each hole into a DbParameter, or keep the Raw API with {0} placeholders and the values as extra arguments. Identifiers (table or column names, sort direction) cannot be parameterised; map them through a fixed allow-list.
References
Source: packages/engine/rules/sast/csharp.yml.
Related checks
- C# SQL injection: value spliced into quoted SQL literal
- C# SQL injection: request input in ADO.NET or Dapper query
- C# Dynamic LINQ injection from request input
- C# command injection via cmd.exe /c, powershell or sh -c
- C# OS command injection: request input in Process.Start
- C# cookie HttpOnly = false exposes it to XSS
Check your own repository for this
vetkit runs this rule as part of a repository audit, alongside secret scanning, dependency vulnerabilities, code quality and AI code risk checks. It reads a temporary checkout and never executes your code.
Start with the free Security Quick Scan · See how the platform works
Generated from shipped rule definitions at build time. Matching is a review signal, not proof of exploitability. “generic” denotes text matching, not complete language or framework coverage. Runtime configuration and available tools affect whether a rule runs.