Bind variables, parameters and ExecuteQuery
Posted: Mon 23 Nov 2015 13:34
Currently using dotConnect for Oracle 8.5.521.0
I cannot find any documentation or examples of the method signature that actually uses parameters.
In particular I am interested in using bind variables if possible. Something like
or do I have to use argument placeholders like:
If its arg placeholder style, what protection does this offer for sql injection attacks?
none, or is the param value internally formatted to avoid malicious values?
...or do I pass OracleParameter objects
Documentation and examples around this seem spectacularly poor and none of the above examples seem to work. Please advise or update documentation for ExecuteQuery and Parameters.
I cannot find any documentation or examples of the method signature that actually uses parameters.
Code: Select all
IEnumerable<TResult> ExecuteQuery<TResult>(string query, params object[] parameters);Code: Select all
context.ExecuteQuery("select colA from tableA where colA = :paramA", "paramAValue");
Code: Select all
context.ExecuteQuery("select colA from tableA where colA = '{0}'", "paramAValue");
none, or is the param value internally formatted to avoid malicious values?
...or do I pass OracleParameter objects
Code: Select all
context.ExecuteQuery("select colA from tableA where colA = :paramA", new OracleParameter("paramA", OracleDbType.NVarChar, 10){ Value = "paramAValue" });