title: EntitySQL and SQL injection
body: <p>I've got the following query string</p>
  
  <pre><code>"SELECT VALUE entity FROM Entities AS entity WHERE entity.Client_id
  = 0 &amp;&amp; entity.Name LIKE @searchvalue ORDER BY @sorting SKIP @skip LIMIT @limit"
  </code></pre>
  
  <p>with the following param replacement</p>
  
  <pre><code>query.Parameters.Add(new ObjectParameter("skip", start));
  query.Parameters.Add(new ObjectParameter("limit", limit));
  query.Parameters.Add(new ObjectParameter("searchvalue", searchValue + "%"));
  query.Parameters.Add(new ObjectParameter("sorting", sortField + " " + sortDirection.ToUpper()));
  </code></pre>
  
  <p>But I always end up in the exception:</p>
  
  <blockquote>
    <p>The key expression 'ORDER BY' must have at least one reference to the
    immediate input scope. Near ORDER BY clause item</p>
  </blockquote>
  
  <p>I guess this happends cause <code>query.Parameters.Add(...)</code> wraps all in quotes? I also read <a href="https://stackoverflow.com/questions/2194848/linq-to-entities-and-sql-injection">this</a> but for what benefit then do I need <code>query.Parameters.Add(...)</code> if nothing can happens? OK, the attacker may not start a new query but I guess he can manipulate the current?</p>