title: Are SQL operator functions for Entity Framework safe against SQL injection?
body: <p>These functions give access to specialty functions (SqlClient) in SQL. For example 'like' or 'between'. And they also give a nicer common abstraction layer for them. Not to be confused with stored procedure(s) "functions" which is the topic of this other <a href="https://stackoverflow.com/questions/11107456/do-entity-framework-functions-automatically-escape-input-to-protect-against-inje">question</a>.</p>
  
  <p>My question that I can't seem to find a full answer for is. Are they safe to use, or am I opening the system to a <a href="http://en.wikipedia.org/wiki/SQL_injection" rel="nofollow noreferrer">SQL injection attack</a>? I always use bound variables when writing regular SqlCommands. </p>
  
  <p>But in moving to Entity Framework. There is less control over the SQL statements. I don't mind it, but I can't help worrying when I concatenate a string coming from a browser and pass it to a function.</p>
  
  <p>Here is an example:</p>
  
  <pre><code>var QueryResult = EFContext.Table.Where(x =&gt; 
      SqlFunctions.PatIndex("%" + Potentially_unsafe_search_keyword + "%", 
                            x.Column) &gt; 0);
  </code></pre>
  
  <p>I did some tests and traced the actual SQL sent to the server. Single quotes are escaped out automatically. So clearly there is some protection there. There is some sanitization taking place. Insert statements do use bind variables. Should I be content with the single quote replacement? Is there something else going on behind the scenes?</p>