How do FromSqlInterpolated and FromSqlRaw differ in EF Core, and which is safe from SQL Injection?

Short answer

FromSqlInterpolated is safe by default because it converts interpolated values into prepared SqlParameter objects, while FromSqlRaw accepts raw text and is vulnerable if you concatenate values.

Explanation

FromSqlInterpolated uses the C# FormattableString type. When you write $"WHERE Name = {input}", it does not concatenate the text; it extracts a parameter, replaces it with @p0, and sends the value separately as a protected parameter. With FromSqlRaw, concatenating strings sends injected commands directly to the database engine.

Code example

// Fully safe from SQL Injection (automatically generates SqlParameter)
var users = await db.Users
    .FromSqlInterpolated($"SELECT * FROM Users WHERE City = {city}")
    .ToListAsync();

Common mistakes

• Using FromSqlRaw with string concatenation on the assumption that the value was validated earlier.

Follow-up questions

• How do ExecuteUpdate and ExecuteDelete in EF Core 7+ improve performance for bulk operations?

Sources

• Microsoft Learn — Raw SQL Queries in EF Core