In dot net if use entity framework should prevent against sql injections. I bet the php code is running on and old version pre mysqli and pdo, or tge coder only knows how to use insecure mysql functions