csharp-database-secure-railguard-available

Overview

This rule enforces safe conventions when generating database access logic in C# applications, including:

• Use of parameterized queries (for example, SqlCommand.Parameters.Add())
• Secure Entity Framework Core practices
• Secrets management and config hygiene
• Logging discipline and output sanitization

Deep reasoning, input handling, and security redlines are defined globally in:

.cursor/rules/railguard-input-validation.mdc

---

Best Practices for ADO.NET

• Use SqlCommand with parameters — never build queries with string concatenation or interpolation
• Use using blocks or try/catch/finally for resource cleanup
• Never log raw SQL with user input
• Wrap sensitive query sections in comments (for example, // Parameterized query for login validation)

Best Practices for Entity Framework Core

• Use DbContext and LINQ to query models
• Annotate entities with [Key], [Table], [Column], etc.
• Use @Transactional or .SaveChanges() batching for state updates
• Avoid dynamic LINQ or raw SQL strings unless absolutely necessary

---

Configuration Hygiene

• Load connection strings from appsettings.json, environment variables, or vaults
• Never hardcode passwords or secrets

"ConnectionStrings": {
  "DefaultConnection": "Server=...;Database=...;User Id=...;Password=...;"
}

---

Logging Guidelines

• Use ILogger or Serilog with structured output
• Do not log parameter values or user-generated query inputs
• Mask fields such as email, token, or user identifiers in logs

---

Code Example

string query = "SELECT * FROM Users WHERE Username = @Username";
using (SqlCommand cmd = new SqlCommand(query, connection)) {
    cmd.Parameters.AddWithValue("@Username", username);
    using (SqlDataReader reader = cmd.ExecuteReader()) {
        while (reader.Read()) {
            // Process user info
        }
    }
}

---

Inline Security Cues

• // Prevents SQL injection via parameterized query
• // Connection string loaded from environment
• // ORM method avoids raw SQL