Question

In ASP.NET MVC3 projects, is it faster, more secure, to use Entity Framework (with the repository pattern) or to use ADO.NET with SqlConnection and SqlCommand?

Answer 1

Very general question but some thoughts.

Performance:

Plain SqlCommand and DataReader will be significantly faster when it comes to performance as long as all the developers has a clue. With .net 4.5 and EF 5 it seems like EF will get a nice performance boost but plain sql will always be faster.

See here for some numbers: http://blogs.msdn.com/b/adonet/archive/2012/02/14/sneak-preview-entity-framework-5-0-performance-improvements.aspx

Plain ADO.NET also supports the async patter which might be very important in some scenarios. EF doesn’t. Atleast not for EF 4.

Security

Plain SQL might be as safe as EF as long as you use paramaterized queries. EF will do this automatically for you to protect you from SQL injection. Because EF always gives you this I would consider it safer but with a slight margin.

Testability

I have found this to be a big win when it comes to EF. Instead of fooling around with mocking I run fast intergration tests against my controllers using SqlCe4. It’s very easy to do this as long as you use EF.

Summary

I find EF very capable and the API is pleasant to work with. If you are doing performance intensive things you will have to drop into raw SqlDataReader and SqlBulkCopy from time to time but mixing them is not a problem. I like to use EF where I can live with the performance loss because I’m more productive. Where I feel the hit is to big I will use plain Sql.