title: Protect API from SQL Injection
body: <p>I am creating an API the method below gets staff by their name in the query parameter or all staff. However, does the <code>[FromQuery(Name = "name")]</code> protect from SQL injection, unsure if this is a default feature of .NET core 2.2?</p>
  
  <pre><code>[HttpGet]
  public IActionResult GetStaff([FromQuery(Name = "name")] string firstName)
  {
      if (firstName == null)
      {
         //get all staff
         var staff = _repo.GetAllStaff().ToList();
         return Ok(staff);
      }
  
      if (firstName != null)
      {
         //get staff by firstName
         var staffByName = _repo.GetStaffByName(firstName).ToList();
         return Ok(staffByName);
      }
  
      return BadRequest("No staff found");
  }
  </code></pre>
  
  <p>Method in Repository</p>
  
  <pre><code>    public IEnumerable&lt;ApiStaff&gt; GetStaffByName(string name)
      {
          var staffName = _context.ApiStaff.Where(k =&gt; k.FirstName == name);
          return staffName;
      }
  </code></pre>