Greg Le Moine
Top achievements
Rank 1
Rank 1
Greg Le Moine
asked on 10 Mar 2010, 05:41 PM
Hi,
I would like to create a Datasource like this "SELECT field FROM table WHERE field = 'cond' @ParamSupp ORDER BY field
In this example, I want to set a empty default value to @ParamSupp to have this => SELECT field FROM table WHERE field = 'cond' ORDER BY field
And in my code, sometimes I would add some parameters to my request. For example, assign "AND field2 = 'cond2 AND field3='cond3'" to have a datasource like this => SELECT field FROM table WHERE field = 'cond' AND field2 = 'cond2 AND field3='cond3' ORDER BY field
Is it possible ? I try different solution like : AND @param with default value '1 = 1', but it doesn't work anymore. So I rewrite entire sql request to this DS at this time. It works fine but my request is in double (in aspx and in code behind), and if I could, I would avoid this.
Thanks in advance.
Greg
I would like to create a Datasource like this "SELECT field FROM table WHERE field = 'cond' @ParamSupp ORDER BY field
In this example, I want to set a empty default value to @ParamSupp to have this => SELECT field FROM table WHERE field = 'cond' ORDER BY field
And in my code, sometimes I would add some parameters to my request. For example, assign "AND field2 = 'cond2 AND field3='cond3'" to have a datasource like this => SELECT field FROM table WHERE field = 'cond' AND field2 = 'cond2 AND field3='cond3' ORDER BY field
Is it possible ? I try different solution like : AND @param with default value '1 = 1', but it doesn't work anymore. So I rewrite entire sql request to this DS at this time. It works fine but my request is in double (in aspx and in code behind), and if I could, I would avoid this.
Thanks in advance.
Greg
2 Answers, 1 is accepted
0
Hi Greg,
I don't think that it is possible to use data source parameters in the way you describe. You can only specify values in the parameters and not SQL as you are trying to do. If it was possible to have SQL in parameter values, this would be a major security risk and using parameters would be no different from simple string concatenation to create your query.
If you want to learn more about data source parameters you can go to MSDN:
http://msdn.microsoft.com/en-us/library/xt50s8kz.aspx
http://msdn.microsoft.com/en-us/library/ms228051.aspx
Regards,
Lini
the Telerik team
Do you want to have your say when we set our development plans? Do you want to know when a feature you care about is added or when a bug fixed? Explore the Telerik Public Issue Tracking system and vote to affect the priority of the items.
I don't think that it is possible to use data source parameters in the way you describe. You can only specify values in the parameters and not SQL as you are trying to do. If it was possible to have SQL in parameter values, this would be a major security risk and using parameters would be no different from simple string concatenation to create your query.
If you want to learn more about data source parameters you can go to MSDN:
http://msdn.microsoft.com/en-us/library/xt50s8kz.aspx
http://msdn.microsoft.com/en-us/library/ms228051.aspx
Regards,
Lini
the Telerik team
Do you want to have your say when we set our development plans? Do you want to know when a feature you care about is added or when a bug fixed? Explore the Telerik Public Issue Tracking system and vote to affect the priority of the items.
0
Greg Le Moine
Top achievements
Rank 1
Rank 1
answered on 15 Mar 2010, 10:49 AM
Thanks a lot,
I know this use of the SqlDataSource will be "improperly" correct for all the risks of SqlInjections or other security problems. So the problem in my case is to rewrite the Sql Command for my SqlDataSource (and so duplicate my SqlCommand) in code behind, but it seems to be the unique solution. (In the case where I don't know the number of my parameters)
To solve this problem, I have created a function "CeateSQLSelectFrom" (return an unique SQL request) and I add parameters after in Where condition. But I must be careful when I insert user parameters to avoid security problems ;o)
Regards