G
G
Goshujin2022-04-13 14:08:45
SQLite
Goshujin, 2022-04-13 14:08:45

How to remove warning EF1000?

The code:

public bool SetNewDate(string date, string newDate)
        {
            string sql = string.Format(@"
UPDATE EventSchedule
SET Date = '{0}'
WHERE Date = '{1}'", newDate, date);

            var rows = _context.Database.ExecuteSqlCommand(sql);

            return rows > 0;
        }


A warning:
warning EF1000: The SQL expression passed to 'ExecuteSqlCommand' embeds data that will not be parameterized.

Answer the question

In order to leave comments, you need to log in

1 answer(s)
V
Vasily Bannikov, 2022-04-13
@Goshujin

Do not use string.Format for parameterization.
Use additional parameters from ExecuteSqlCommand or ExecuteSqlInterpolated instead.
https://docs.microsoft.com/en-us/ef/core/querying/...

Didn't find what you were looking for?

Ask your question

Ask a Question

731 491 924 answers to any question