Skip to main content

EF Core - Cannot convert from 'string' to 'System.FormattableString'

While doing a pair programming session with a new developer in one of my teams, we ended up with a compiler error after writing the following code:

This is the error message we got:

Argument 2: cannot convert from 'string' to 'System.FormattableString' 

The fix was easy just add a ‘$’ before the query:

However it would not have been a good pair programming session if we didn’t drill down further into this.

What is a FormattableString?

A FormattableString in C# is a type introduced in .NET 4.6. It represents a composite format string, which consists of fixed text intermixed with indexed placeholders (format items). These placeholders correspond to the objects in a list. The key features of FormattableString are:

  1. Capturing Information Before Formatting:

    • A FormattableString captures both the format string (similar to what you’d pass to string.Format, e.g., "Hello, {0}") and the arguments that would be used to format it.
    • Crucially, this information is captured before actual formatting occurs.
  2. Adjustable Formatting:

    • You can adjust the formatting behavior of a FormattableString, such as performing formatting in the invariant culture.
    • This is useful when you want to control how the string is formatted without actually performing the formatting immediately.
  3. Usage with Interpolated Strings:

    • When you use an interpolated string (e.g., $"Hello, {name}"), the compiler will create a FormattableString if you assign it to an IFormattable variable.
    • The IFormattable.ToString(string, CultureInfo) implementation of the interpolated string will use FormattableString

The last key feature explains why adding a ‘$’ sign and creating an interpolated string fixes the compiler error.

FormattableString and EF Core

But that doesn’t explain yet why the EF Core team decided to expect a FormattableString instead of a ‘normal’ string when calling the FromSql() method.

The reason a FormattableString is expected is because it helps you to safe guard against SQL injection, as they integrate parameter data as separate SQL parameters.

Let's have a look at the following example:

Although the query above looks like regular C# string interpolation, the categoryId value is wrapped in a DbParameter and the generated parameter name inserted where the placeholder was specified.

This is the query that got executed in the database:

This makes FromSql safe from SQL injection attacks, and sends the value efficiently and correctly to the database.

Popular posts from this blog

DevToys–A swiss army knife for developers

As a developer there are a lot of small tasks you need to do as part of your coding, debugging and testing activities.  DevToys is an offline windows app that tries to help you with these tasks. Instead of using different websites you get a fully offline experience offering help for a large list of tasks. Many tools are available. Here is the current list: Converters JSON <> YAML Timestamp Number Base Cron Parser Encoders / Decoders HTML URL Base64 Text & Image GZip JWT Decoder Formatters JSON SQL XML Generators Hash (MD5, SHA1, SHA256, SHA512) UUID 1 and 4 Lorem Ipsum Checksum Text Escape / Unescape Inspector & Case Converter Regex Tester Text Comparer XML Validator Markdown Preview Graphic Color B

Help! I accidently enabled HSTS–on localhost

I ran into an issue after accidently enabling HSTS for a website on localhost. This was not an issue for the original website that was running in IIS and had a certificate configured. But when I tried to run an Angular app a little bit later on http://localhost:4200 the browser redirected me immediately to https://localhost . Whoops! That was not what I wanted in this case. To fix it, you need to go the network settings of your browser, there are available at: chrome://net-internals/#hsts edge://net-internals/#hsts brave://net-internals/#hsts Enter ‘localhost’ in the domain textbox under the Delete domain security policies section and hit Delete . That should do the trick…

Azure DevOps/ GitHub emoji

I’m really bad at remembering emoji’s. So here is cheat sheet with all emoji’s that can be used in tools that support the github emoji markdown markup: All credits go to rcaviers who created this list.