title: SQLInjection against CosmosDB in an Azure function
body: <p>I have implemented an Azure function that is triggered by a HttpRequest. A parameter called <code>name</code> is passed as part of the HttpRequest. In <strong><code>Integration</code></strong> section, I have used the following query to retrieve data from CosmosDB (as an input):</p>
  
  <pre><code>SELECT * FROM c.my_collection pm 
  WHERE
  Contains(pm.first_name,{name}) 
  </code></pre>
  
  <p>As you see I am sending the 'name' without <code>sanitizing</code> it. Is there any <code>SQLInjection</code> concern here?</p>
  
  <p>I searched and noticed that <code>parameterization</code> is available but that is not something I can do anything about here.</p>