Even if the ID variable is an integer (and therefore you're immune to injection), it's still inefficient. If you use the command "select * from Customer where ID=@id" and you set ID as a parameter instead, then caching can happen behind the scenes ("prepared statements").

See the justifications at https://www.npgsql.org/doc/basic-usage.html#parameters, for example. My experience is only with Postgres, but I imagine they translate.

The opening bracket in a new line is very common for C/C++ and C#.

Obviously Standards change, but that's what we learned when I went to school.

The only thing that should matter with style is consistency.

IIRC some old unix book recommended splitting type declaration, prototype and body on different lines, like this:

    int
    myFunc(char *str, int strlen)
    {
         <body>
    }

with the rationale being that grepping for ^myFunc (or searching for it in vi) would have found the function declaration immediately.

Not sure I like that, anyway.

Agree. It hasn't changed, it's still what Microsofts C# style guide recommends.

https://docs.microsoft.com/en-us/dotnet/csharp/programming-g...

It's also what VS Code autoformats even C++ to by default.

Also I wonder if the other commenters reflexively saying "SQL injection" realize that is just the symptom; the underlying problem is that LINQ is not used. Even if the SQL injection was fixed, a literal SQL query is usually not the right tool in C#.

Re: braces on their own lines, one practical advantage of doing so (leaving aside subjective anesthetics like symmetry) is that source control (at least got) will be able to automatically distinguish and merge changes to the header and the body independently, since they're no longer adjacent.

Code is vulnerable to SQL injection. And yes the opening bracket on a new line hurts.