using System;

using System.Text.Json;

​

string maliciousInput = "{0} % $0 -- DROP TABLE \"USERS\"";

​

// Always, always, ALWAYS use a proper serializer for assembling formats like JSON.

// The malicious input can include actual JavaScript, and it'll be correctly encoded with 100% safety.

string encoded = JsonSerializer.Serialize( new {

    context= "{0}",      // .NET format string placeholder

    input=maliciousInput

});

​

// This will just work, formatting placeholders are ignored if no parameters are specified

Console.WriteLine(encoded);

​

// A safe FormatException is thrown if you mis-use the string formmating code. 

// No vulnerability other than DDoS.

Console.WriteLine(encoded, "adfasfd");