Entityframework Executesqlcommand not accepting parameter

Question

I’m running the Executesqlcommand.

In the right way, parameter doesn’t work:

var SQL = "update POSTOFFICE set Status = 1 where name = '@url'";
dbMailEnable.Database.ExecuteSqlCommand(SQL, new SqlParameter("@url", EP.Cliente.Url.Trim().ToLower()));

Parameter-less works!

var SQL = "update POSTOFFICE set Status = 1 where name = '" + EP.Cliente.Url.Trim().ToLower() + "'";
dbMailEnable.Database.ExecuteSqlCommand(SQL);

But without parameter is not recommended, SQL Injection, etc. alias in Visual Studio help nor it was possible.

What to do?

NOTE: I’m having to use this command because the database is of third party and has no primary key so I could not do via Model.

Answer 1

If the idea is to use as ADO.NET, you can get the DbConnection of context and execute the command using SqlParameters normally:

using (var connection = dbMailEnable.Database.Connection as SqlConnection) // Não tem problema ~neste caso~ porque o Entity Framework garante uma SqlConnection pra você. 
{
    var command = new SqlCommand("update POSTOFFICE set Status = 1 where name = '@url'", connection);
    command.Parameters.Add(new SqlParameter("@url", EP.Cliente.Url.Trim().ToLower()));
    var registrosAfetados = command.ExecuteNonQuery();
}