Is my LINQ query safe and efficient?

Question

I am relatively new to LINQ queries as I normally just use plain SQL to get my data back but i am changing for the good - Anyway obviously with SQL you pass in parameters so you do not get any SQL injections etc. Now the LINQ query I have written I think is safe but I am thinking it may be able to done a little easier and more efficient.

So I am passing in my data in the query from the model which is being sent from the view and my tables columns are being called from the ProjectLinqDataContext class. Is this safe? is there anything which I am doing which is not best practice.

 var context = new ProjectLinqDataContext();
 var user = from y in context.Customers
               where y.CustomerUsername == model.Email && y.CustomerPassword == model.Password
               select y;

Answer 1

Your ProjectLinqDataContext is disposable so make sure to wrap the usage in a using statement. Efficiency will be based on how your database is indexed. The query itself looks fine. You can also use method syntax for a more fluent and object oriented look. This doesn't affect anything, but I think it's much more readable.

using(var context = new ProjectLinqDataContext())
{
    var user = context.Customers.FirstOrDefault(y => y.CustomerUsername == model.Email && y.CustomerPassword == model.Password);
    //do something with user if it's not null
}

Make sure your password has been hashed and salted of course.