using System;

using System.Runtime.CompilerServices;

public class Program

{

    public static void Main()

    {

        ServerMethod("David'; DROP TABLE tbl; --");

​

    }

​

    private static void ServerMethod(string filter)

    {

​

        Console.WriteLine(FromSql("SELECT * FROM tbl WHERE fld = '" + filter + "'"));

        Console.WriteLine(FromSql($"SELECT * FROM tbl WHERE fld = {filter}"));

        Console.WriteLine(FromSql(FormattableStringFactory.Create("SELECT * FROM tbl WHERE fld = {0}", filter)));

​

    }

​

    private static string FromSql(string sql) => sql;

​

    private static string FromSql(FormattableString sql)

    {   

        var formatArgs = sql.GetArguments();

​

        for (var paramIndex = 0; paramIndex < sql.ArgumentCount; ++paramIndex)

            formatArgs[paramIndex] = "@p" + paramIndex;

​

        return sql.ToString();

    }

}

​