DapperLib / DapperLib/Dapper

[Feature Request] Using InterpolatedStringHandler for templated command, becuase its pretty

Open
#2,066 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
C#
Stars
18.4k
Forks
3.7k
Avg merge
5h 8m
Merged PRs (30d)
1

Description

Idea is simple, but i know there will be some pushback from people who scream SQL injection.

Im wrote my own micro ORM, there is outdated open source version here (this is link to relevant file): https://github.com/LittleNetworkHack/Crone/blob/main/Crone.Core/Components/Data/CoreDataCommandBuilder.cs

I use string builder for command text and dictionary to store parameters before converting it into ADO.NET provider specific command.
The way i use it is following:

public static void TestCommand(string ownerName, string viewName)
{
	CoreDataCommandBuilder command =
	$"""
	SELECT *
	FROM   ALL_VIEWS
	WHERE  OWNER = {ownerName}
	AND    VIEW_NAME = {viewName}
	""";

	var result = _provider.ExecuteDataTable(command);
}

This transalted into command text with placeholder and optionally (if bind by name) with name:

SELECT *
FROM   ALL_VIEWS
WHERE  OWNER = ~@ownerName
AND    VIEW_NAME = ~@viewName

Then ~@ is replace with provider specific binder like : for oracle.
Command from dictionary are added as parameters.

Pros:
Proper multiline command support
IDE highlight where parameters are actually places not just big orange text

Cons:
Idk, you tell me

Iterpolated string builder supports overloading for AppendFormatted types like integer, decimal, datetime...
I even handle int[] or string[] for SELECT * FROM TABLE WHERE ID IN ({array_parameter}) so i convert them into CSV value added directly into command text, this can be further sanitized if needed.

This is just idea, let me know what you think about it, i can go into more details about implementation if needed. Like support for formatting {DateTime.Now:YYYY-MM-DD} and RAW for actual SQL injection.

NOTE: ive built this before i saw EF Core doing something similar with execute raw sql, since i always wanted to write commands in a way that felt natural to me.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the linked CoreDataCommandBuilder.cs and the issue's InterpolatedStringHandler example to understand the proposed command and parameter behavior. The issue has no agreed target or acceptance criteria, so clarify the API scope, parameter and array handling, formatting rules, and required SQL-injection safety before implementation.

Written by the indexing model from the issue text.

Assessment

Tech stack
csharp, sql
Domain
databases
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.