i want to know something that if we use DBEntities like this in view that is right way or not? means that is security issue or not in our project? Any Suggestion or Recommendation Please.
VIEW
@using proName.Models
@{
proNameEntities DB = new proNameEntities();
}
<div class"">
@{
int conID;
var UserExist = DB.Users.Where(x => x.UserID =conID).FirstOrDefault();
if (UserExist != null)
{
<p>@UserExist.name</p>
}
}
</div>
To follow an MVC pattern you should:
Create a viewmodel object
class ViewModel{
public List<Users> Users {get; set;} // whatever the name of your entity is
}
Populate that ViewModel with your list from the controller side:
public class HomeController : Controller {
proNameEntities DB = new proNameEntities(); //initalise db entities here
public ActionResult Index(){
ViewModel vm = new ViewModel();
vm.Users = this.DB.Users
return View(vm); // pass the viewmodel object to the view
}
}
At the top of the View, indicate the type of object it is receiving:
@model ViewModel //use full path if it's not in the same scope
Then use your viewmodels list in the view:
@{
foreach (user in Users){
//do something
}
}
Ideally, you would also want to do that UserExist logic inside your controller. So create a new property on the viewmodel, perform your check from the controller, then insert the data into the ViewModel object, and pass it to the View.
its not correct and not recommended
The codes that are related to backend should be written in the controller (also recommended by Microsoft)
write in the code in controller then pass result by model to view
It is not correct, because it violates MVC (refers to Model-View-Controller).
Controller responsibility is to link database to view. Putting database logic in view will make your code very bad and hard to maintain, test.
Besides, you cancelled the role of ViewModel
Rather than putting your business/database code into View (MVC), you should inject the view data into Action. like below code:
public ActionResult Index()
{
var conID = 1; //BASED ON DATA-INPUT
var userExists = DB.Users.Where(x => x.UserID = conID).FirstOrDefault();
return View(userExists?.Name);
}
