// 輸入驗證範例
public class UserController : ControllerBase
{
    [HttpPost]
    public async Task<IActionResult> CreateUser([FromBody] CreateUserRequest request)
    {
        // 輸入驗證
        if (!ModelState.IsValid)
            return BadRequest(ModelState);
            
        // 清理輸入資料
        var sanitizedRequest = _sanitizer.Sanitize(request);
        
        // 使用參數化查詢
        var user = await _userService.CreateUserAsync(sanitizedRequest);
        
        return Ok(user);
    }
}

public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
{
    // 安全標頭
    app.UseHsts();
    app.UseHttpsRedirection();
    
    // CSP 設定
    app.Use(async (context, next) =>
    {
        context.Response.Headers.Add("Content-Security-Policy", 
            "default-src 'self'; script-src 'self' 'unsafe-inline'");
        context.Response.Headers.Add("X-Frame-Options", "DENY");
        context.Response.Headers.Add("X-Content-Type-Options", "nosniff");
        await next();
    });
}

// 使用 Entity Framework 參數化查詢
public async Task<User> GetUserAsync(int id)
{
    return await _context.Users
        .Where(u => u.Id == id)
        .FirstOrDefaultAsync(); // 自動參數化
}

// 避免原始 SQL（如果必須使用，請使用參數）
public async Task<List<User>> SearchUsersAsync(string searchTerm)
{
    return await _context.Users
        .FromSqlRaw("SELECT * FROM Users WHERE Name LIKE {0}", $"%{searchTerm}%")
        .ToListAsync();
}

// 設定檔加密
public class EncryptedConfigurationProvider : IConfigurationProvider
{
    public void Set(string key, string value)
    {
        if (IsSensitiveKey(key))
        {
            value = _encryptionService.Encrypt(value);
        }
        // 儲存設定...
    }
}

// 密碼雜湊
public class PasswordService
{
    public string HashPassword(string password)
    {
        return BCrypt.Net.BCrypt.HashPassword(password, 12);
    }
    
    public bool VerifyPassword(string password, string hash)
    {
        return BCrypt.Net.BCrypt.Verify(password, hash);
    }
}