FromSql

using Microsoft.EntityFrameworkCore;

public sealed class CustomerLookup(ShopDb db)
{
    // Injectable: email = "x' OR '1'='1" returns every customer.
    public Task<List<Customer>> ByEmailUnsafe(string email, CancellationToken ct) =>
        db.Customers.FromSqlRaw("SELECT * FROM \"Customers\" WHERE \"Email\" = '" + email + "'")
            .ToListAsync(ct);

    // Safe: the hole becomes a parameter; the SQL text never contains the value.
    public Task<List<Customer>> ByEmail(string email, CancellationToken ct) =>
        db.Customers.FromSql($"SELECT * FROM \"Customers\" WHERE \"Email\" = {email}")
            .AsNoTracking()
            .ToListAsync(ct);

    // Also safe: FromSqlRaw with positional parameters.
    public Task<List<Customer>> ByEmailRaw(string email, CancellationToken ct) =>
        db.Customers.FromSqlRaw("SELECT * FROM \"Customers\" WHERE \"Email\" = {0}", email)
            .AsNoTracking()
            .ToListAsync(ct);
}

public class Customer
{
    public int Id { get; set; }
    public string Email { get; set; } = "";
}

public class ShopDb(DbContextOptions<ShopDb> options) : DbContext(options)
{
    public DbSet<Customer> Customers => Set<Customer>();
}

using Microsoft.EntityFrameworkCore;

public record DailyRevenue(DateOnly Day, decimal Revenue, int Orders);

public sealed class RevenueReport(ShopDb db)
{
    // Column aliases must match the record's property names.
    public Task<List<DailyRevenue>> Last30Days(Guid tenantId, CancellationToken ct) =>
        db.Database.SqlQuery<DailyRevenue>($@"
            SELECT date_trunc('day', o.""PlacedAt"")::date AS ""Day"",
                   sum(o.""Total"")                         AS ""Revenue"",
                   count(*)::int                            AS ""Orders""
            FROM ""Orders"" AS o
            WHERE o.""TenantId"" = {tenantId}
              AND o.""PlacedAt"" >= now() - interval '30 days'
            GROUP BY 1")
            .OrderBy(r => r.Day)
            .ToListAsync(ct);
}

public class Order
{
    public int Id { get; set; }
    public Guid TenantId { get; set; }
    public decimal Total { get; set; }
    public DateTimeOffset PlacedAt { get; set; }
}

public class ShopDb(DbContextOptions<ShopDb> options) : DbContext(options)
{
    public DbSet<Order> Orders => Set<Order>();
}

using Microsoft.EntityFrameworkCore;

public sealed class ProductBrowse(CatalogDb db)
{
    // Identifiers cannot be parameters, so map the client's choice to fixed SQL text.
    private static readonly Dictionary<string, string> SortColumns = new(StringComparer.OrdinalIgnoreCase)
    {
        ["price"] = "\"Price\"",
        ["name"] = "\"Name\"",
        ["newest"] = "\"CreatedAt\" DESC",
    };

    public async Task<List<Product>> Page(string sort, int categoryId, CancellationToken ct)
    {
        if (!SortColumns.TryGetValue(sort, out var orderBy))
            throw new ArgumentOutOfRangeException(nameof(sort), sort, "Unknown sort.");

        // The one allowed exception: orderBy is fixed text from the dictionary, never client input.
        // No interpolation (which EF1002 flags); categoryId is still a parameter through {0}.
        var sql = "SELECT * FROM \"Products\" WHERE \"CategoryId\" = {0} ORDER BY " + orderBy + " LIMIT 50";
        return await db.Products
            .FromSqlRaw(sql, categoryId)
            .AsNoTracking()
            .ToListAsync(ct);
    }

    // Usually better: no raw SQL at all, the sort is a LINQ switch.
    public Task<List<Product>> PageLinq(string sort, int categoryId, CancellationToken ct)
    {
        var query = db.Products.AsNoTracking().Where(p => p.CategoryId == categoryId);
        query = sort.ToLowerInvariant() switch
        {
            "price" => query.OrderBy(p => p.Price),
            "name" => query.OrderBy(p => p.Name),
            "newest" => query.OrderByDescending(p => p.CreatedAt),
            _ => throw new ArgumentOutOfRangeException(nameof(sort), sort, "Unknown sort."),
        };
        return query.Take(50).ToListAsync(ct);
    }
}

public class Product
{
    public int Id { get; set; }
    public int CategoryId { get; set; }
    public string Name { get; set; } = "";
    public decimal Price { get; set; }
    public DateTimeOffset CreatedAt { get; set; }
}

public class CatalogDb(DbContextOptions<CatalogDb> options) : DbContext(options)
{
    public DbSet<Product> Products => Set<Product>();
}