Changes between Version 23 and Version 24 of P9

Timestamp:

06/23/26 00:10:08 (3 days ago)

Author:

211099

Comment:

--

P9

@@ -864 +864 @@
     throw new UnauthorizedAccessException("Invalid email or password.");
 }}}
+
+== SQL Injection Prevention
+To reduce the risk of SQL injection, ChapterX uses Entity Framework Core as its ORM instead of writing raw SQL queries. EF Core automatically generates parameterized queries under the hood, user-supplied values are never concatenated directly into query strings.
+
+Because all database access goes through EF Core's API, parameterization is handled implicitly:
+{{{
+public async Task<T?> GetByIdAsync(int id, CancellationToken cancellationToken = default)
+    => await _dbSet.FindAsync([id], cancellationToken);
+
+public async Task AddAsync(T entity, CancellationToken cancellationToken = default)
+{
+    await _dbSet.AddAsync(entity, cancellationToken);
+    await _context.SaveChangesAsync(cancellationToken);
+}
+}}}
+Custom queries in repositories follow the same pattern — LINQ expressions are translated by EF Core into parameterized SQL, so user input is always treated as a value, never as executable SQL:
+{{{
+public async Task<User?> GetByEmailAsync(string email, CancellationToken cancellationToken = default)
+    => await _dbSet.FirstOrDefaultAsync(u => u.Email == email, cancellationToken);
+public async Task<IEnumerable<Chapter>> GetByStoryIdAsync(int storyId, CancellationToken cancellationToken = default)
+    => await _dbSet.Where(c => c.StoryId == storyId).ToListAsync(cancellationToken);
+}}}