From 253ac748a877819e38c0cf7aa148f87df65db1c9 Mon Sep 17 00:00:00 2001 From: 2881099 <2881099@qq.com> Date: Sat, 13 Aug 2022 18:19:42 +0800 Subject: [PATCH] update --- 动态操作.md | 64 ++++++++++++++++++++++++++--------------------------- 1 file changed, 32 insertions(+), 32 deletions(-) diff --git a/动态操作.md b/动态操作.md index 656db12..120c90e 100644 --- a/动态操作.md +++ b/动态操作.md @@ -1,35 +1,3 @@ -## 动态片段 - -FreeSql 提供 Where(sql)、GroupBy(sql)、OrderBy(sql)、ToList(sql) 等直接使用 SQL 片段的 API。 - -**使用这些 API 时请务必注意SQL注入安全问题。** - -不建议前端直接 POST SQL 到后端使用它们,而应该在后端做一层映射,例如: - -```csharp -var whereMapping = new Dictionary -{ - ["where1"] = "a.id > {0}", - ["where2"] = "len(a.name) > {0}" -}; -var orderByMapping = new Dictionary -{ - ["order1"] = "a.id asc, a.name desc", - ["order2"] = "len(a.name) desc" -}; - -//假设前端 POST 内容是 postWhere=where1&postWhereValue=100&postOrder=order1 -fsql.Select() - .WhereIf( - whereMapping.TryGetValue(postWhere, out var whereSql), - string.Format(whereSql, postWhereValue) - ) - .OrderBy( - orderByMapping.TryGetValue(postOrder, out var orderSql), - orderSql - ) -``` - ## 弱类型 CRUD ```csharp @@ -173,4 +141,36 @@ DataTable dt = fsql.Select() "Parent.Code", //导航属性模式 "b.Id" //多表查询模式 }); +``` + +## 动态片段 + +FreeSql 提供 Where(sql)、GroupBy(sql)、OrderBy(sql)、ToList(sql) 等直接使用 SQL 片段的 API。 + +**使用这些 API 时请务必注意SQL注入安全问题。** + +不建议前端直接 POST SQL 到后端使用它们,而应该在后端做一层映射,例如: + +```csharp +var whereMapping = new Dictionary +{ + ["where1"] = "a.id > {0}", + ["where2"] = "len(a.name) > {0}" +}; +var orderByMapping = new Dictionary +{ + ["order1"] = "a.id asc, a.name desc", + ["order2"] = "len(a.name) desc" +}; + +//假设前端 POST 内容是 postWhere=where1&postWhereValue=100&postOrder=order1 +fsql.Select() + .WhereIf( + whereMapping.TryGetValue(postWhere, out var whereSql), + string.Format(whereSql, postWhereValue) + ) + .OrderBy( + orderByMapping.TryGetValue(postOrder, out var orderSql), + orderSql + ) ``` \ No newline at end of file