What is the advantage of using parameters over using string interpolation?
Is this
SELECT * FROM dbo.Posts WHERE Author = @p0", userSuppliedAuthor;
any better than
$@SELECT * FROM dbo.Posts WHERE Author = {userSuppliedAuthor}";
?
Join Stack Overflow to learn, share knowledge, and build your career.
What is the advantage of using parameters over using string interpolation?
Is this
SELECT * FROM dbo.Posts WHERE Author = @p0", userSuppliedAuthor;
any better than
$@SELECT * FROM dbo.Posts WHERE Author = {userSuppliedAuthor}";
?
String interpolation is just a syntax sugar for formatting string. It gives you no protection against SQL injection. You should use SQL parameters to provide values for your query.
Consider - what if userSuppliedAuthor
equals to
'Bob' OR 1 = 1
Or even
'Bob'; DROP TABLE Users;
Further reading SQL Injection
In addition to SQL injection issues mentioned by Sergey, you can have issues with totally valid strings that contain certain characters, like "'", "." and "@" characters that mean things to SQL and need to be handled. It's always best to parameterize queries to prevent these issues, not only with injection when going straight from user input, but even something as simple as an email address or a possessive in a title.