Why should you care?

SQL injection is still a top breach path; ShopNest code review bans string SQL.

See it live — copy this example

Use a .NET console or API project with SQL Server LocalDB. Run dotnet run after pasting.

// bad: $"... WHERE Email = '{email}'"
cmd.CommandText = "SELECT Id FROM Users WHERE Email = @Email";
cmd.Parameters.Add("@Email", SqlDbType.NVarChar, 256).Value = email;

What happened?

• Correct SqlDbType and size.
• AddWithValue can guess wrong types — prefer explicit Add.

Practice next

1. Demo injection on bad pattern in lab.
2. Fix with parameter.
3. Grep for $"SELECT.
4. Pass OR 1=1 payload safely.
5. Use NVarChar size limits.

Remember

Always SqlParameter. Typed sizes. No concat.

ShopNest secure login lookup

Email lookup parameterized.

Outcome: Injection attempts return no rows, not all users.