title: Entity Framework Core - .Contains() - Why escaping instead of parametrization?
body: <p>In a web application, I get user input in the form of a <code>List&lt;string&gt;</code> from the ViewModel and use this information to select the Ids of the users with the following  code:</p>
  
  <pre><code>var selectedUsersIds = Context.Users
  .Where(user =&gt; SelectedUsers.Contains(user.Email))
  .Select(user =&gt; user.Id)
  .ToList();
  </code></pre>
  
  <p><code>SelectedUsers</code> is the list of strings (user emails).</p>
  
  <p>Now, while viewing the application logs I encountered the following log entry:</p>
  
  <pre><code>info: Microsoft.Data.Entity.Storage.Internal.RelationalCommandBuilderFactory[1]
    Executed DbCommand (0ms) [Parameters=[], CommandType='Text', CommandTimeout='30']
    SELECT [user].[Id]
    FROM [AspNetUsers] AS [user]
    WHERE [user].[Email] IN ('first@user.com', 'second@user.com')
  </code></pre>
  
  <p>So the next task was to use a rest client and use <code>some@user'--</code> as form parameter and I got this result:</p>
  
  <pre><code>info: Microsoft.Data.Entity.Storage.Internal.RelationalCommandBuilderFactory[1]
    Executed DbCommand (1ms) [Parameters=[], CommandType='Text', CommandTimeout='30']
    SELECT [user].[Id]
    FROM [AspNetUsers] AS [user]
    WHERE [user].[Email] IN ('some@user''--')
  </code></pre>
  
  <p>Here, the <code>single '</code> got escaped to a <code>double ''</code>. This behaviour seems consistent with 
  <a href="https://github.com/aspnet/EntityFramework/wiki/Security#security-guarantee-update-pipeline-uses-parameterization-and-escaping" rel="nofollow">what is described in the docs under "Security Guarantee: LINQ queries use parameterization and escaping"</a>, which states that queries will either be parametrized or escaped.</p>
  
  <p>I wonder, however, how is it decided when a query is parametrized and when to escape values? What reasons are there to chose either one?
  And I thought that escaping was never 100% safe, is this different now?</p>