EF Core raw query with Like clause

Question

I want to create queries using EF FromSqlInterpolated or FromSqlRaw that allows me to use Like clauses, but I don't know what is the right way to do it without opening the application to SqlInjection attacks. One first approach has took me to the following code

var results = _context.Categories.FromSqlInterpolated(
$"Select * from Category where name like {"%" + partialName + "%"}");

First test worked fine, it returns results when providing expected strings, and returns nothing when i provide something like ';select * from Category Where name='Notes'--%'; Still I don't know much about SqlInjection, at least not enough to feel safe with the query shown before. Does someone know if the query is safe, or if there is a right way to do it? Thanks

Answer 1

From this document

The FromSqlInterpolated and ExecuteSqlInterpolated methods allow using string interpolation syntax in a way that protects against SQL injection attacks.

var results = _context.Categories.FromSqlInterpolated(
$"Select * from Category where name like {"%" + partialName + "%"}");

Or you can also change your query to Linq-to-Entity like this way

var results = _context.Categories.Where(p => p.name.Contains(partialName ));