Skip to content
This repository was archived by the owner on Dec 24, 2022. It is now read-only.

Commit 7922f58

Browse files
mythzmythz
committed
Change all InsertOnly and ToInsertRowStatement() to use parameterized queries
1 parent 203d4bc commit 7922f58

15 files changed

+95
-41
lines changed

‎src/ServiceStack.OrmLite.Firebird/FirebirdOrmLiteDialectProvider.cs

Lines changed: 18 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -128,11 +128,13 @@ public override string ToInsertRowStatement(IDbCommand cmd, object objWithProper
128128
var tableType = objWithProperties.GetType();
129129
var modelDef = GetModel(tableType);
130130

131-
foreach (var fieldDef in modelDef.FieldDefinitions)
131+
foreach (var fieldDef in modelDef.FieldDefinitionsArray)
132132
{
133133

134-
if (fieldDef.IsComputed) continue;
135-
if (insertFields.Count > 0 && !insertFields.Contains(fieldDef.Name)) continue;
134+
if (fieldDef.IsComputed)
135+
continue;
136+
if (insertFields.Count > 0 && !insertFields.Contains(fieldDef.Name))
137+
continue;
136138

137139
if ((fieldDef.AutoIncrement || !string.IsNullOrEmpty(fieldDef.Sequence)
138140
|| fieldDef.Name == OrmLiteConfig.IdField)
@@ -151,11 +153,19 @@ public override string ToInsertRowStatement(IDbCommand cmd, object objWithProper
151153
if (sbColumnValues.Length > 0)
152154
sbColumnValues.Append(",");
153155

154-
sbColumnNames.Append(string.Format("{0}", GetQuotedColumnName(fieldDef.FieldName)));
155-
if (!string.IsNullOrEmpty(fieldDef.Sequence) && cmd == null)
156-
sbColumnValues.Append(string.Format("@{0}", fieldDef.Name));
157-
else
158-
sbColumnValues.Append(fieldDef.GetQuotedValue(objWithProperties));
156+
try
157+
{
158+
sbColumnNames.Append(GetQuotedColumnName(fieldDef.FieldName));
159+
sbColumnValues.Append(this.GetParam(SanitizeFieldNameForParamName(fieldDef.FieldName)));
160+
161+
var p = AddParameter(cmd, fieldDef);
162+
p.Value = fieldDef.GetValue(objWithProperties) ?? DBNull.Value;
163+
}
164+
catch (Exception ex)
165+
{
166+
Log.Error("ERROR in ToInsertRowStatement(): " + ex.Message, ex);
167+
throw;
168+
}
159169
}
160170

161171
var sql = string.Format("INSERT INTO {0} ({1}) VALUES ({2});",

‎src/ServiceStack.OrmLite.Oracle/OracleOrmLiteDialectProvider.cs

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -652,6 +652,7 @@ public override void SetParameterValue<T>(FieldDefinition fieldDef, IDataParamet
652652
// return value;
653653
//}
654654

655+
//TODO: Change to parameterized query to match all other ToInsertRowStatement() impls
655656
public override string ToInsertRowStatement(IDbCommand dbCommand, object objWithProperties, ICollection<string> insertFields = null)
656657
{
657658
if (insertFields == null)
@@ -665,8 +666,10 @@ public override string ToInsertRowStatement(IDbCommand dbCommand, object objWith
665666

666667
foreach (var fieldDef in modelDef.FieldDefinitions)
667668
{
668-
if (fieldDef.IsComputed) continue;
669-
if (insertFields.Count > 0 && !insertFields.Contains(fieldDef.Name)) continue;
669+
if (fieldDef.IsComputed)
670+
continue;
671+
if (insertFields.Count > 0 && !insertFields.Contains(fieldDef.Name))
672+
continue;
670673

671674
if ((fieldDef.AutoIncrement || !string.IsNullOrEmpty(fieldDef.Sequence))
672675
&& dbCommand != null)

‎src/ServiceStack.OrmLite/Async/WriteExpressionCommandExtensionsAsync.cs

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -98,14 +98,12 @@ internal static Task<int> UpdateAsync<T>(this IDbCommand dbCmd, object updateOnl
9898
return dbCmd.ExecNonQueryAsync(token);
9999
}
100100

101-
internal static Task InsertOnlyAsync<T>(this IDbCommand dbCmd, T obj, Expression<Func<T, object>> onlyFields, CancellationToken token)
101+
internal static Task InsertOnlyAsync<T>(this IDbCommand dbCmd, T obj, string[] onlyFields, CancellationToken token)
102102
{
103103
if (OrmLiteConfig.InsertFilter != null)
104104
OrmLiteConfig.InsertFilter(dbCmd, obj);
105105

106-
var q = dbCmd.GetDialectProvider().SqlExpression<T>().Insert(onlyFields);
107-
108-
var sql = dbCmd.GetDialectProvider().ToInsertRowStatement(dbCmd, obj, q.InsertFields);
106+
var sql = dbCmd.GetDialectProvider().ToInsertRowStatement(dbCmd, obj, onlyFields);
109107
return dbCmd.ExecuteSqlAsync(sql, token);
110108
}
111109

‎src/ServiceStack.OrmLite/Expressions/WriteExpressionCommandExtensions.cs

Lines changed: 2 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -138,15 +138,12 @@ internal static void PrepareUpdateAnonSql<T>(this IDbCommand dbCmd, IOrmLiteDial
138138
dialectProvider.GetQuotedTableName(modelDef), StringBuilderCache.ReturnAndFree(sql), whereSql);
139139
}
140140

141-
public static void InsertOnly<T>(this IDbCommand dbCmd, T obj, Expression<Func<T, object>> onlyFields)
141+
public static void InsertOnly<T>(this IDbCommand dbCmd, T obj, string[] onlyFields)
142142
{
143143
if (OrmLiteConfig.InsertFilter != null)
144144
OrmLiteConfig.InsertFilter(dbCmd, obj);
145145

146-
var q = dbCmd.GetDialectProvider().SqlExpression<T>();
147-
q.Insert(onlyFields);
148-
149-
var sql = dbCmd.GetDialectProvider().ToInsertRowStatement(dbCmd, obj, q.InsertFields);
146+
var sql = dbCmd.GetDialectProvider().ToInsertRowStatement(dbCmd, obj, onlyFields);
150147
dbCmd.ExecuteSql(sql);
151148
}
152149

‎src/ServiceStack.OrmLite/IOrmLiteDialectProvider.cs

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -101,7 +101,7 @@ string GetColumnDefinition(
101101

102102
string ToSelectStatement(ModelDefinition modelDef, string selectExpression, string bodyExpression, string orderByExpression = null, int? offset = null, int? rows = null);
103103

104-
string ToInsertRowStatement(IDbCommand command, object objWithProperties, ICollection<string> InsertFields = null);
104+
string ToInsertRowStatement(IDbCommand cmd, object objWithProperties, ICollection<string> InsertFields = null);
105105

106106
void PrepareParameterizedInsertStatement<T>(IDbCommand cmd, ICollection<string> insertFields = null);
107107

‎src/ServiceStack.OrmLite/OrmLiteDialectProviderBase.cs

Lines changed: 15 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -565,8 +565,7 @@ public virtual string GetColumnNames(ModelDefinition modelDef)
565565
return StringBuilderCache.ReturnAndFree(sqlColumns);
566566
}
567567

568-
/// Fmt
569-
public virtual string ToInsertRowStatement(IDbCommand command, object objWithProperties, ICollection<string> insertFields = null)
568+
public virtual string ToInsertRowStatement(IDbCommand cmd, object objWithProperties, ICollection<string> insertFields = null)
570569
{
571570
if (insertFields == null)
572571
insertFields = new List<string>();
@@ -575,22 +574,26 @@ public virtual string ToInsertRowStatement(IDbCommand command, object objWithPro
575574
var sbColumnValues = StringBuilderCacheAlt.Allocate();
576575
var modelDef = objWithProperties.GetType().GetModelDefinition();
577576

578-
foreach (var fieldDef in modelDef.FieldDefinitions)
577+
foreach (var fieldDef in modelDef.FieldDefinitionsArray)
579578
{
580579
if (fieldDef.ShouldSkipInsert())
581580
continue;
582581

583-
//insertFields contains Property "Name" of fields to insert ( that's how expressions work )
584582
if (insertFields.Count > 0 && !insertFields.Contains(fieldDef.Name))
585583
continue;
586584

587-
if (sbColumnNames.Length > 0) sbColumnNames.Append(",");
588-
if (sbColumnValues.Length > 0) sbColumnValues.Append(",");
585+
if (sbColumnNames.Length > 0)
586+
sbColumnNames.Append(",");
587+
if (sbColumnValues.Length > 0)
588+
sbColumnValues.Append(",");
589589

590590
try
591591
{
592592
sbColumnNames.Append(GetQuotedColumnName(fieldDef.FieldName));
593-
sbColumnValues.Append(fieldDef.GetQuotedValue(objWithProperties, this));
593+
sbColumnValues.Append(this.GetParam(SanitizeFieldNameForParamName(fieldDef.FieldName)));
594+
595+
var p = AddParameter(cmd, fieldDef);
596+
p.Value = fieldDef.GetValue(objWithProperties) ?? DBNull.Value;
594597
}
595598
catch (Exception ex)
596599
{
@@ -777,11 +780,12 @@ public virtual void PrepareStoredProcedureStatement<T>(IDbCommand cmd, T obj)
777780
cmd.CommandType = CommandType.StoredProcedure;
778781
}
779782

780-
protected void AddParameter(IDbCommand cmd, FieldDefinition fieldDef)
783+
protected IDbDataParameter AddParameter(IDbCommand cmd, FieldDefinition fieldDef)
781784
{
782785
var p = cmd.CreateParameter();
783786
SetParameter(fieldDef, p);
784787
cmd.Parameters.Add(p);
788+
return p;
785789
}
786790

787791
public virtual void SetParameter(FieldDefinition fieldDef, IDbDataParameter p)
@@ -823,7 +827,7 @@ protected virtual object GetValue<T>(FieldDefinition fieldDef, object obj)
823827
{
824828
var value = obj is T
825829
? fieldDef.GetValue(obj)
826-
: GetAnonValue<T>(fieldDef, obj);
830+
: GetAnonValue(fieldDef, obj);
827831

828832
return GetFieldValue(fieldDef, value);
829833
}
@@ -877,7 +881,7 @@ protected virtual object GetQuotedValueOrDbNull<T>(FieldDefinition fieldDef, obj
877881
{
878882
var value = obj is T
879883
? fieldDef.GetValue(obj)
880-
: GetAnonValue<T>(fieldDef, obj);
884+
: GetAnonValue(fieldDef, obj);
881885

882886
if (value == null)
883887
return DBNull.Value;
@@ -894,7 +898,7 @@ protected virtual object GetQuotedValueOrDbNull<T>(FieldDefinition fieldDef, obj
894898
static readonly ConcurrentDictionary<string, PropertyGetterDelegate> anonValueFnMap =
895899
new ConcurrentDictionary<string, PropertyGetterDelegate>();
896900

897-
protected virtual object GetAnonValue<T>(FieldDefinition fieldDef, object obj)
901+
protected virtual object GetAnonValue(FieldDefinition fieldDef, object obj)
898902
{
899903
var anonType = obj.GetType();
900904
var key = anonType.Name + "." + fieldDef.Name;

‎src/ServiceStack.OrmLite/OrmLiteWriteExpressionsApi.cs

Lines changed: 15 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -137,10 +137,24 @@ public static int Update<T>(this IDbConnection dbConn, object updateOnly, Expres
137137
/// <summary>
138138
/// Using an SqlExpression to only Insert the fields specified, e.g:
139139
///
140-
/// db.InsertOnly(new Person { FirstName = "Amy" }, p => new { p.FirstName }));
140+
/// db.InsertOnly(new Person { FirstName = "Amy" }, p => p.FirstName));
141141
/// INSERT INTO "Person" ("FirstName") VALUES ('Amy');
142+
///
143+
/// db.InsertOnly(new Person { Id =1 , FirstName="Amy" }, p => new { p.Id, p.FirstName }));
144+
/// INSERT INTO "Person" ("Id", "FirstName") VALUES (1, 'Amy');
142145
/// </summary>
143146
public static void InsertOnly<T>(this IDbConnection dbConn, T obj, Expression<Func<T, object>> onlyFields)
147+
{
148+
dbConn.Exec(dbCmd => dbCmd.InsertOnly(obj, onlyFields.GetFieldNames()));
149+
}
150+
151+
/// <summary>
152+
/// Using an SqlExpression to only Insert the fields specified, e.g:
153+
///
154+
/// db.InsertOnly(new Person { FirstName = "Amy" }, new[]{ "FirstName" }));
155+
/// INSERT INTO "Person" ("FirstName") VALUES ('Amy');
156+
/// </summary>
157+
public static void InsertOnly<T>(this IDbConnection dbConn, T obj, string[] onlyFields)
144158
{
145159
dbConn.Exec(dbCmd => dbCmd.InsertOnly(obj, onlyFields));
146160
}

‎src/ServiceStack.OrmLite/OrmLiteWriteExpressionsApiAsync.cs

Lines changed: 15 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -145,10 +145,24 @@ public static Task<int> UpdateAddAsync<T>(this IDbConnection dbConn,
145145
/// <summary>
146146
/// Using an SqlExpression to only Insert the fields specified, e.g:
147147
///
148-
/// db.InsertOnly(new Person { FirstName = "Amy" }, p => new { p.FirstName });
148+
/// db.InsertOnlyAsync(new Person { FirstName = "Amy" }, p => p.FirstName));
149149
/// INSERT INTO "Person" ("FirstName") VALUES ('Amy');
150+
///
151+
/// db.InsertOnlyAsync(new Person { Id =1 , FirstName="Amy" }, p => new { p.Id, p.FirstName }));
152+
/// INSERT INTO "Person" ("Id", "FirstName") VALUES (1, 'Amy');
150153
/// </summary>
151154
public static Task InsertOnlyAsync<T>(this IDbConnection dbConn, T obj, Expression<Func<T, object>> onlyFields, CancellationToken token = default(CancellationToken))
155+
{
156+
return dbConn.Exec(dbCmd => dbCmd.InsertOnlyAsync(obj, onlyFields.GetFieldNames(), token));
157+
}
158+
159+
/// <summary>
160+
/// Using an SqlExpression to only Insert the fields specified, e.g:
161+
///
162+
/// db.InsertOnly(new Person { FirstName = "Amy" }, new[]{ "FirstName" }));
163+
/// INSERT INTO "Person" ("FirstName") VALUES ('Amy');
164+
/// </summary>
165+
public static Task InsertOnlyAsync<T>(this IDbConnection dbConn, T obj, string[] onlyFields, CancellationToken token = default(CancellationToken))
152166
{
153167
return dbConn.Exec(dbCmd => dbCmd.InsertOnlyAsync(obj, onlyFields, token));
154168
}

‎tests/ServiceStack.OrmLite.Tests/ApiSqlServerTests.cs

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -240,7 +240,7 @@ public void API_SqlServer_Examples()
240240
Assert.That(db.GetLastSql(), Is.EqualTo("INSERT INTO \"Person\" (\"Id\",\"FirstName\",\"LastName\",\"Age\") VALUES (@Id,@FirstName,@LastName,@Age)"));
241241

242242
db.InsertOnly(new PersonWithAutoId { FirstName = "Amy", Age = 27 }, x => new { x.FirstName, x.Age });
243-
Assert.That(db.GetLastSql(), Is.EqualTo("INSERT INTO \"PersonWithAutoId\" (\"FirstName\",\"Age\") VALUES ('Amy',27)"));
243+
Assert.That(db.GetLastSql(), Is.EqualTo("INSERT INTO \"PersonWithAutoId\" (\"FirstName\",\"Age\") VALUES (@FirstName,@Age)"));
244244

245245
db.InsertOnly(() => new PersonWithAutoId { FirstName = "Amy", Age = 27 });
246246
Assert.That(db.GetLastSql(), Is.EqualTo("INSERT INTO \"PersonWithAutoId\" (\"FirstName\",\"Age\") VALUES (@FirstName,@Age)"));

‎tests/ServiceStack.OrmLite.Tests/ApiSqliteTests.cs

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -245,7 +245,7 @@ public void API_Sqlite_Examples()
245245
Assert.That(db.GetLastSql(), Is.EqualTo("INSERT INTO \"Person\" (\"Id\",\"FirstName\",\"LastName\",\"Age\") VALUES (@Id,@FirstName,@LastName,@Age)"));
246246

247247
db.InsertOnly(new PersonWithAutoId { FirstName = "Amy", Age = 27 }, p => new { p.FirstName, p.Age });
248-
Assert.That(db.GetLastSql(), Is.EqualTo("INSERT INTO \"PersonWithAutoId\" (\"FirstName\",\"Age\") VALUES ('Amy',27)"));
248+
Assert.That(db.GetLastSql(), Is.EqualTo("INSERT INTO \"PersonWithAutoId\" (\"FirstName\",\"Age\") VALUES (@FirstName,@Age)"));
249249

250250
db.InsertOnly(() => new PersonWithAutoId { FirstName = "Amy", Age = 27 });
251251
Assert.That(db.GetLastSql(), Is.EqualTo("INSERT INTO \"PersonWithAutoId\" (\"FirstName\",\"Age\") VALUES (@FirstName,@Age)"));

0 commit comments

Comments
 (0)