Error while Querying scalar with context.Database function about efcore.pg

[roji]

That is all covered in the docs: columns/table names cannot be parameterized in databases, so you must use string interpolation to construct your SQL, and that can vulnerable to SQL injection. What point exactly do you think isn't covered in the docs?

[Millarex]

I apologize for the incorrect test example with the table name. I will give an example from real code, where there is no reference to table names or any other part of the schema.
Used Npgsql.EntityFrameworkCore.PostgreSQL.NetTopologySuite 8.0.0

This code have EF1002 warning, but work correct. How can I rewrite the code correctly so that I don't get EF1002?

var point = new Point(10, 10);
var tolerance = 50;
var wktPoint = point.ToText().Replace(",", "");
var bufferedPoint = await dbContext.Database
    .SqlQueryRaw<Geometry>($"SELECT ST_Buffer(ST_GeogFromText('{wktPoint}'), {tolerance}, 8) as \"Value\"")
    .FirstOrDefaultAsync(cancellationToken: cancellationToken);

I try this, but have error.

var point = new Point(10, 10);
var tolerance = 50;
var wktPoint = point.ToText().Replace(",", "");
var bufferedPoint = await dbContext.Database
     .SqlQueryRaw<Geometry>("SELECT ST_Buffer(ST_GeogFromText('@wktPoint'), @tolerance, 8) as \"Value\""
     ,new NpgsqlParameter<string>("wktPoint",wktPoint),new NpgsqlParameter<int>("tolerance",tolerance))
     .FirstOrDefaultAsync();

[roji]

Why are you using SqlQueryRaw as opposed to SqlQuery, which provides parameter safety?

[Millarex]

I understood what the problem was. I called the method like this and got an error. I didn’t notice that this construction is not string interpolation. Single quotes '{wktPoint}' played a cruel joke on me. Thank you for helping me figure out the problem, sorry for wasting your time

.SqlQuery<Geometry>($"SELECT ST_Buffer(ST_GeogFromText('{wktPoint}'), {tolerance}, 8) as \"Value\"")
//valid variant
.SqlQuery<Geometry>($"SELECT ST_Buffer(ST_GeogFromText({wktPoint}), {tolerance}, 8) as \"Value\"")