From 9c818424967547f5669a138e5a1960735e9b7bbb Mon Sep 17 00:00:00 2001 From: Shay Rojansky Date: Wed, 18 Aug 2021 13:39:43 +0200 Subject: [PATCH] Correctly FromSqlRaw docs Fixes #25567 --- .../RelationalDatabaseFacadeExtensions.cs | 14 +++++++------- .../RelationalQueryableExtensions.cs | 18 +++++++++--------- 2 files changed, 16 insertions(+), 16 deletions(-) diff --git a/src/EFCore.Relational/Extensions/RelationalDatabaseFacadeExtensions.cs b/src/EFCore.Relational/Extensions/RelationalDatabaseFacadeExtensions.cs index 86daf2aa99e..58940cda9a6 100644 --- a/src/EFCore.Relational/Extensions/RelationalDatabaseFacadeExtensions.cs +++ b/src/EFCore.Relational/Extensions/RelationalDatabaseFacadeExtensions.cs @@ -131,7 +131,7 @@ public static Task MigrateAsync( /// /// /// var userSuppliedSearchTerm = ".NET"; - /// context.Database.ExecuteSqlRaw("UPDATE [dbo].[SearchBlogs] SET [Rank] = 50 WHERE [Name] = {0}", userSuppliedSearchTerm); + /// context.Database.ExecuteSqlRaw("UPDATE Blogs SET Rank = 50 WHERE Name = {0}", userSuppliedSearchTerm); /// /// /// However, never pass a concatenated or interpolated string ($"") with non-validated user-provided values @@ -170,7 +170,7 @@ public static int ExecuteSqlRaw( /// /// /// var userSuppliedSearchTerm = ".NET"; - /// context.Database.ExecuteSqlInterpolated($"UPDATE [dbo].[SearchBlogs] SET [Rank] = 50 WHERE [Name] = {userSuppliedSearchTerm})"); + /// context.Database.ExecuteSqlInterpolated($"UPDATE Blogs SET Rank = 50 WHERE Name = {userSuppliedSearchTerm})"); /// /// /// The for the context. @@ -202,7 +202,7 @@ public static int ExecuteSqlInterpolated( /// /// /// var userSuppliedSearchTerm = ".NET"; - /// context.Database.ExecuteSqlRaw("UPDATE [dbo].[SearchBlogs] SET [Rank] = 50 WHERE [Name] = {0}", userSuppliedSearchTerm); + /// context.Database.ExecuteSqlRaw("UPDATE Blogs SET Rank = 50 WHERE Name = {0}", userSuppliedSearchTerm); /// /// /// However, never pass a concatenated or interpolated string ($"") with non-validated user-provided values @@ -273,7 +273,7 @@ public static int ExecuteSqlRaw( /// /// /// var userSuppliedSearchTerm = ".NET"; - /// context.Database.ExecuteSqlInterpolatedAsync($"UPDATE [dbo].[SearchBlogs] SET [Rank] = 50 WHERE [Name] = {userSuppliedSearchTerm})"); + /// context.Database.ExecuteSqlInterpolatedAsync($"UPDATE Blogs SET Rank = 50 WHERE Name = {userSuppliedSearchTerm})"); /// /// /// The for the context. @@ -305,7 +305,7 @@ public static Task ExecuteSqlInterpolatedAsync( /// /// /// var userSuppliedSearchTerm = ".NET"; - /// context.Database.ExecuteSqlRawAsync("UPDATE [dbo].[SearchBlogs] SET [Rank] = 50 WHERE [Name] = {0}", userSuppliedSearchTerm); + /// context.Database.ExecuteSqlRawAsync("UPDATE Blogs SET Rank = 50 WHERE Name = {0}", userSuppliedSearchTerm); /// /// /// Never pass a concatenated or interpolated string ($"") with non-validated user-provided values @@ -346,7 +346,7 @@ public static Task ExecuteSqlRawAsync( /// /// /// var userSuppliedSearchTerm = ".NET"; - /// context.Database.ExecuteSqlRawAsync("UPDATE [dbo].[SearchBlogs] SET [Rank] = 50 WHERE [Name] = {0}", userSuppliedSearchTerm); + /// context.Database.ExecuteSqlRawAsync("UPDATE Blogs SET Rank = 50 WHERE Name = {0}", userSuppliedSearchTerm); /// /// /// However, never pass a concatenated or interpolated string ($"") with non-validated user-provided values @@ -387,7 +387,7 @@ public static Task ExecuteSqlRawAsync( /// /// /// var userSuppliedSearchTerm = ".NET"; - /// context.Database.ExecuteSqlRawAsync("UPDATE [dbo].[SearchBlogs] SET [Rank] = 50 WHERE [Name] = {0}", userSuppliedSearchTerm); + /// context.Database.ExecuteSqlRawAsync("UPDATE Blogs SET Rank = 50 WHERE Name = {0}", userSuppliedSearchTerm); /// /// /// However, never pass a concatenated or interpolated string ($"") with non-validated user-provided values diff --git a/src/EFCore.Relational/Extensions/RelationalQueryableExtensions.cs b/src/EFCore.Relational/Extensions/RelationalQueryableExtensions.cs index 6d149842b93..384acc798fd 100644 --- a/src/EFCore.Relational/Extensions/RelationalQueryableExtensions.cs +++ b/src/EFCore.Relational/Extensions/RelationalQueryableExtensions.cs @@ -62,24 +62,24 @@ public static DbCommand CreateDbCommand(this IQueryable source) /// /// /// If the database provider supports composing on the supplied SQL, you can compose on top of the raw SQL query using - /// LINQ operators: context.Blogs.FromSqlRaw("SELECT * FROM dbo.Blogs").OrderBy(b => b.Name). + /// LINQ operators: context.Blogs.FromSqlRaw("SELECT * FROM Blogs").OrderBy(b => b.Name). /// /// /// As with any API that accepts SQL it is important to parameterize any user input to protect against a SQL injection /// attack. You can include parameter place holders in the SQL query string and then supply parameter values as additional - /// arguments. Any parameter values you supply will automatically be converted to a DbParameter: + /// arguments. Any parameter values you supply will automatically be converted to a : /// - /// context.Blogs.FromSqlRaw("SELECT * FROM [dbo].[SearchBlogs]({0})", userSuppliedSearchTerm) + /// context.Blogs.FromSqlRaw("SELECT * FROM Blogs WHERE Name = {0}", userSuppliedSearchTerm) /// /// However, never pass a concatenated or interpolated string ($"") with non-validated user-provided values /// into this method. Doing so may expose your application to SQL injection attacks. To use the interpolated string syntax, /// consider using to create parameters. /// /// - /// This overload also accepts DbParameter instances as parameter values. This allows you to use named - /// parameters in the SQL query string: + /// This overload also accepts instances as parameter values. In addition to using positional + /// placeholders as above ({0}), you can also use named placeholders directly in the SQL query string: /// - /// context.Blogs.FromSqlRaw("SELECT * FROM [dbo].[SearchBlogs]({@searchTerm})", new SqlParameter("@searchTerm", userSuppliedSearchTerm)) + /// context.Blogs.FromSqlRaw("SELECT * FROM Blogs WHERE Name = @searchTerm", new SqlParameter("@searchTerm", userSuppliedSearchTerm)) /// /// The type of the elements of . /// @@ -115,13 +115,13 @@ public static IQueryable FromSqlRaw( /// If the database provider supports composing on the supplied SQL, you can compose on top of the raw SQL query using /// LINQ operators: /// - /// context.Blogs.FromSqlInterpolated($"SELECT * FROM dbo.Blogs").OrderBy(b => b.Name) + /// context.Blogs.FromSqlInterpolated($"SELECT * FROM Blogs").OrderBy(b => b.Name) /// /// As with any API that accepts SQL it is important to parameterize any user input to protect against a SQL injection /// attack. You can include interpolated parameter place holders in the SQL query string. Any interpolated parameter values - /// you supply will automatically be converted to a DbParameter: + /// you supply will automatically be converted to a : /// - /// context.Blogs.FromSqlInterpolated($"SELECT * FROM [dbo].[SearchBlogs]({userSuppliedSearchTerm})") + /// context.Blogs.FromSqlInterpolated($"SELECT * FROM Blogs WHERE Name = {userSuppliedSearchTerm}") /// /// The type of the elements of . ///