I have many Windows services which run on the server side only. It performs few CRUD operations on a database (MySQL).
There is a client application which allows a user to upload files through it to the server. When the file gets uploaded to the server, Window Service performs required operations on this file and update the details in Database through SQL queries.
Client App(Desktop App) -> File -> Upload on Server -> Window Service Process File -> Database Entry
I was wondering if such kind of architecture really requires parameterized query to prevent SQL injection?