Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

The updated SqlQuery function of .NET 8 is pretty cool. It takes a string but safely interpolates the parameters.

https://learn.microsoft.com/en-us/ef/core/what-is-new/ef-cor...

https://timdeschryver.dev/blog/you-can-now-return-unmapped-t...

"With the new SqlQuery method, you can now write your own SQL queries and map the result to any type that you want.

This is useful for tasks that are not directly related to the day-to-day business of your application. For example, this can be used to import data, migrate data, or to retrieve data from a legacy system."



Sooo it’s dapper with string interpolation override to make queries parameterized so you don’t need to manually put the parameters on as 2nd arguments?


It's not just interpolation. The interpolation handler rewrites the query and makes it safe from SQL injection.

There's an add-on to Dapper that does similar:

https://github.com/mishael-o/Dapper.SimpleSqlBuilder


> Sooo it’s dapper with string interpolation override to make queries parameterized so you don’t need to manually put the parameters on as 2nd arguments?

Pretty much. C# does some really cool innovations around string interpolation which proves very useful for logging, SQL query etc.

You can create your own string interpolation handler, which is what the new SQL query does and what several log libraries do. So basically you can use interpolation safely and remain assured that you do not introduce SQL injection errors. Also, this way string interpolation does not prevent query plan caching, as normal string interpolation would do.




Consider applying for YC's Fall 2026 batch! Applications are open till July 27.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: