如何在 C# 中将字符串列表作为 SQL 参数传递

Question

I am using entity framework. I have been told the suggested way of executing direct sql is to use parameters instead of directly inserting values into the query string. i tried making invidual sql parameters and realize there is a 2100 parameter limitation (i had 8000 string params in the list)... I can get this working by passing the value directly to the mySQLQuery string, but i want to know how to passing it as a parameter to avoid sql injection attacks? I tried the code below

var mySQLQueryString = "...WHERE DataID IN (@mySQLVariable)";
List<string> dataList = new List<string>();
SqlParameter param = new SqlParameter("@mySQLVariable", string.Join(",", dataList.ToArray()));
return context.Database.SqlQuery<ConcretePOCO>(mySQLQueryString, param).ToList();

When looking at it through a profiler, the data being sent to the SQL is '1,2,3,4'...i need it to be '1', '2', '3', '4'....

how do i accomplish this while sending as a parameter?

Answer 1

How about using Table Valued Parameters in EF :

Create a new Type in SQL

CREATE TYPE DataIds AS TABLE  
(  
    DataID int 
) 

In your method, create a new DataTable from your list

using System.Ling;
using System.Data;
// ...

var dataIds = new DataTable();  
dataIds.Columns.Add("DataID", typeof(int));

List<string> dataList = new List<string>();
// do what ever to fill your list with parameters

foreach (String item in dataList)
{
    DataRow row = dataIds.NewRow();
    row["DataID"] = item;
    table.Rows.Add(row);
}

// When fetching data
var mySQLQueryString = "...WHERE DataID IN (SELECT DataID FROM @mySQLVariable)";
SqlParameter param = new SqlParameter("@mySQLVariable", SqlDbType.Structured);  
param.Value = dataIds;  
param.TypeName = "dbo.DataIds";  
return context.Database.SqlQuery<ConcretePOCO>(mySQLQueryString, param).ToList();

Answer 2

Use a delimiter when passing to sql and then use STRING_SPLIT in the sql to break it up into a table.

Example:

SqlParameter param = new SqlParameter("@mySQLVariable", string.Join("**~**", dataList.ToArray()));

And then in sql do

select value FROM STRING_SPLIT(@mySQLVariable, '~')

Answer 3

There are several ways I can think of to get this done. One possible way of doing this is just to keep the work on the server, and not in the query. Keep in mind that depending on how much data we're talking about, this might not be the fastest process. But if we're only talking about 9,000, then it should be okay.

Using LINQ with Entity Framework, and if your Id's are alphanumeric, then this should work. Your syntax may vary based on your implementation...

var myResults= context.MyTable.Any(t => t.DataID.Intersect(dataList));

Now, if this ends up being too slow, then you can convert your list of ID's to a HashSet .

 var myHashSet = new HashSet<string>(dataList);   
 var myResults = context.MyTable.Where(t => myHashSet.Overlaps(t.DataID));

(Disclaimer: I've not tested any of this. I'm going off memory.)