Entity Framework Core 8.0

Apply the C# 12 and .NET 8 baseline first. These rules cover Entity Framework Core 8.0 through servicing release 8.0.30, including queries, writes, tenancy, transactions, migrations, and diagnostics.

Queries and raw SQL

• Keep query structure in LINQ or a constant SQL template. With relational providers, pass values through FromSql, FromSqlInterpolated, SqlQuery, or interpolated ExecuteSql, which create database parameters.
• Treat FromSqlRaw, SqlQueryRaw, and ExecuteSqlRaw as injection-sensitive APIs: use them only with reviewed SQL text and bind every value through explicit DbParameter objects on relational providers. For Cosmos FromSqlRaw, use placeholders and pass parameter values separately. Map requested identifiers, sort directions, operators, and SQL fragments through fixed allowlists because parameters cannot represent SQL structure.
• Never run SQL copied from ToQueryString() or EF logs as though it retained the original parameter bindings; those outputs are for diagnostics, not an execution boundary.
• Put tenant, ownership, authorization, and row-limit predicates in the server-translated query before AsEnumerable, AsAsyncEnumerable, ToList*, or another materialization call. Do not let a client-selectable Include, order, grouping, or projection create unbounded joins or result sets.
• Cap collection sizes, page sizes, query duration, and returned columns. Avoid lazy loading on response graphs because property access during serialization or logging can trigger hidden, repeated queries and expose navigations the endpoint did not