title: Entity Framework + sql injection
body: <p>I'm building up an <code>IQueryable</code> where I am applying relevant filters, and I come across this line of code here.</p>
  
  <pre><code>items = items.OrderBy(string.Format("{0} {1}", sortBy, sortDirection));
  </code></pre>
  
  <p>Is this snippet vulnerable to SQL injection? Or are these (string) parameters parameterized behind the scenes? I assumed that all Linq queries were escaped and parameterized for me, but the fact that I am able to pass in a string directly like this is throwing me off.</p>