Passing a StringBuilder to an interpolated string #7336
-
Hi, A typical use case is the creation of SQL statements. Code typically looks like this var sql = new StringBuilder();
sql.Append($"INSERT INTO {name} ({col1},{col2},{col3}, ...)\nVALUES ");
AppendRecords(sql, records); So you have both string interpolation and appending strings or scalars manual to a The idea is simply to enable passing the var sql = new StringBuilder();
$(sql)"INSERT INTO {name} ({col1},{col2},{col3}, ...)\nVALUES ";
AppendRecords(sql, records); As a result:
|
Beta Was this translation helpful? Give feedback.
Replies: 1 comment 4 replies
-
DO NOT use string builder or raw string manipulation to construct SQL. It's the most common source of SQL injection risk.
It doesn't. From .NET 6 and C# 10, the interpolated string won't be constructed into a string first. It's passed as raw parts to an interpolated string handler defined by the callee, if there is one. See https://learn.microsoft.com/en-us/dotnet/csharp/whats-new/tutorials/interpolated-string-handler. |
Beta Was this translation helpful? Give feedback.
And
StringBuilder
does explicitly have an overload ofAppend
which supports an interpolation handler, so:is lowered into: