Prevent injection with Dapper stored procedure?

Question

Say that I have this Dapper code :

connection.Execute("dbo.boardgame_collection_insert @param1, @param2, @param3, @param4", boardgameCollection.BoardgameList);

Will this be injection safe or do I have to use something like DynamicParameters?

It seems like Dapper is just a thin layer and that would mean that I have to write code to specify type of input.

This is used in an ASP.NET Core project.

Answer 1

You should be fine

[Fact]
public void TestSqlInjectionParam()
{
    Assert.Equal("Robert ');DROP TABLE Students;--", 
        connection.Query<string>("select @d", 
        new { d = "Robert ');DROP TABLE Students;--" }).First());
}