What is an example of an ORM query that causes SQL Injections and one that does not?

Question

This answer describes how an ORM doesn't protect me from SQL injections, however I'm not entirely clear on how I would "do things wrong" vs "doing things right".

Can someone provide an example in EntityFramework, or Telerik OpenAccess on how SQL injection can be done, and mitigated?

Answer 1

Any mature ORM will be void of sql-injection vulnerabilities as long as you communicate through the object model. So if you have a method (with Entity Framework) that executes

dbContext.Companies.Where(c => c.Name == someParameterFromUI)

a user can enter a search parameter like "'x'; drop table Users;", but the query engine will parametrize the query and the only result is that no companies will be found (unless some company was a barrel of laughs when they coined their name).

But..

Any mature ORM will have its backdoors by which you can write vulnerable code if you insist. NHibernate and EF (I don't know OpenAccess) offer ways to send raw SQL queries to the database. So you can use them as unsafe as you want. I'd rather say though, that doing so you're not using an ORM any more. You're only using the database connection that the ORM tool kindly exposes in a user-friendly API.