title: FromSql(): Query string building from string list to prevent injection
body: <p>I'm building an SQL search in EF Core. Microsoft recommends you do not concat string because it leaves the application vulnerable to SQL injection as detailed in Microsoft Documentation: <a href="https://docs.microsoft.com/en-us/ef/core/querying/raw-sql" rel="nofollow noreferrer">https://docs.microsoft.com/en-us/ef/core/querying/raw-sql</a>.</p>
  
  <blockquote>
    <p>Always use parameterization for raw SQL queries: In addition to
    validating user input, always use parameterization for any values used
    in a raw SQL query/command. APIs that accept a raw SQL string such as
    FromSql and ExecuteSqlCommand allow values to be easily passed as
    parameters. Overloads of FromSql and ExecuteSqlCommand that accept
    FormattableString also allow using string interpolation syntaxt in a
    way that helps protect against SQL injection attacks.</p>
    
    <p>If you are using string concatenation or interpolation to dynamically
    build any part of the query string, or passing user input to
    statements or stored procedures that can execute those inputs as
    dynamic SQL, then you are responsible for validating any input to
    protect against SQL injection attacks.</p>
  </blockquote>
  
  <p>The information that's stored in this database is not sensitive, but obviously I would not like to leave the database vulnerable.</p>
  
  <p>I have a param <code>List&lt;string&gt; searchTerms</code> that I need to iterate through and build a query based this list.</p>
  
  <p>I'm going to and the strings together with my SQL query, but I can only see how to do this with concatenation.  Right now my code looks like this.</p>
  
  <pre><code>var query = String.Format("SELECT ... where MySqlField like '%{0}%'", searchTerm[0]);
  
  for (int i = 1; i &lt; searchTerm.Count(); i++)
  {
      query += String.Format(" and MySqlField like '%{0}%'", searchTerm[i]);
  }
  
  var results = context.MySqlTable.FromSql(query);
  </code></pre>
  
  <p>Even though I'm using interpolation, would extra validation be enough here? Am I missing anything?</p>
  
  <p>Is there a linq query that can do the same thing with a list?</p>