如何使用GET将连接字符串作为参数传递？

Question

I have a asp.net web api and I need to get email list from the database. I need to pass the database connection string as parameter. I know it is not safe to pass connection string like that, but that's the requirement. Whenever I pass in the connection string, the Rest client gives me 404 - Not Found. But I set the connection string within the database class, it's working. So how can I pass the connection as string and make it to retrieve the emails from database?

Code to retrieve data from db

public List<EmailContacts> getEmailContacts(string connstr)
    {
        List<EmailContacts> emailList = new List<EmailContacts>();

        MySqlDataReader rdr = null;
        MySqlConnection myconn = new MySqlConnection(connstr);
        String sqlstr = "SELECT * FROM emailcontacts";
        MySqlCommand cmd = new MySqlCommand(sqlstr, myconn);
        myconn.Open();
        rdr = cmd.ExecuteReader();
        while (rdr.Read())
        {
            EmailContacts e = new EmailContacts();
            e.Id = rdr.GetInt32(0);
            e.Name = rdr.GetString(1);
            e.Email = rdr.GetString(2);

            emailList.Add(e);
        }
        rdr.Close();
        myconn.Close();
        myconn.Dispose();
        return emailList;
    }

Get Api

[HttpGet]
    [Route("api/EmailContacts/{connstr}")]
    public List<EmailContacts> Get(string connstr)
    {
        SalesDBConn db = new SalesDBConn();
        return db.getEmailContacts(connstr);
    }

This is how I tried to pass the connection string in the rest client

http://localhost:59547/api/EmailContacts/server = example.com; uid = myusername; pwd = mypassword; database = mydb_example

Answer 1

you need to URL Encode your parameter. your request should be

http://localhost:59547/api/EmailContacts/server%20%3D%20example.com%3B%20uid%20%3D%20myusername%3B%20pwd%20%3D%20mypassword%3B%20database%20%3D%20mydb_exampl

and yes, this is extremely not secure.

Answer 2

Bring in HttpUtility and UrlEncode the parameter.

This is very vulnerable to attacks though in future if your db is hosted online. What is the issue with storing it in the Api's app settings?

If there are multiple connection string possible you could store them on a shared db against the Api and call them by Id by passing a Guid as the Api param?