Class SqlInOperator<T>

Namespace

Cuemon.Data.SqlClient

Assembly

Cuemon.Data.SqlClient.dll

Provides a safe way to include a Transact-SQL WHERE clause with an IN operator to execute against a SQL Server database.

public class SqlInOperator<T> : InOperator<T>

Type Parameters

T

The type of the data in the IN operation of the WHERE clause to execute against a SQL Server database.

Inheritance

object

InOperator<T>

SqlInOperator<T>

Inherited Members

InOperator<T>.ParameterPrefix

InOperator<T>.ArgumentsSelector(T, int)

InOperator<T>.ToSafeResult(params T[])

InOperator<T>.ToSafeResult(IEnumerable<T>, Func<IEnumerable<string>, string>)

Examples

The following example demonstrates how to use to safely generate parameterized SQL IN clauses that are protected against SQL injection.

using System;
using System.Data;
using Cuemon.Data;
using Cuemon.Data.SqlClient;
using Microsoft.Data.SqlClient;

namespace MyApp.Examples
{
    public sealed class SqlInOperatorExample
    {
        public void Demonstrate()
        {
            var inOperator = new SqlInOperator<string>(() => "@color");
            InOperatorResult result = inOperator.ToSafeResult("Red", "Green", "Blue");

            var commandText = $"SELECT * FROM Products WHERE Color IN ({result})";
            using var command = new SqlCommand(commandText);

            foreach (IDataParameter dbParameter in result.ToParametersArray())
            {
                command.Parameters.Add((SqlParameter)dbParameter);
                Console.WriteLine($"{dbParameter.ParameterName} = {dbParameter.Value}");
            }

            Console.WriteLine(command.CommandText);
            Console.WriteLine(string.Join(", ", result.Arguments));
        }
    }
}

Constructors

SqlInOperator(Func<string>)

Initializes a new instance of the InOperator<T> class.

public SqlInOperator(Func<string> parameterPrefixGenerator = null)

Parameters

parameterPrefixGenerator Func<string>

The function delegate that generates a random prefix for a parameter name.

Methods

ParametersSelector(T, int)

A callback method that is responsible for the values passed to the ToSafeResult(params T[]) method.

protected override IDbDataParameter ParametersSelector(T expression, int index)

Parameters

expression T

An expression to test for a match in the IN operator.

index int

The index of the expression.

Returns

IDbDataParameter

An IDbDataParameter representing the value of the expression.