C# 7 string interpolation after reading string from database

Question

I have a string coming from database.

var query = @"Select SKUs from dbo.Order order by OrderDate OFFSET {skip} ROWS FETCH NEXT {take} ROWS ONLY"

This string is coming from database directly, so I dont have this string formed in code. I want to use $ interpolation to replace them

var skip = 0;
var take = 200;
query = $query

Is there any way I can do this? I know I can use replace or string.format but just curious if we can do this.

Why not use a parameterized query and eliminate any possibility of errors or SQL injection? — Panagiotis Kanavos
– Panagiotis Kanavos, Commented Apr 18, 2022 at 12:05
Echoing @PanagiotisKanavos, reading a query (ie "code") from an external source then executing it is a very dangerous idea. — gunr2171
– gunr2171, Commented Apr 18, 2022 at 12:05

gunr2171 · Accepted Answer · 2022-04-18 12:02:55Z

2

The $"" syntax is only for string literals.

The $ special character identifies a string literal as an interpolated string. An interpolated string is a string literal that might contain interpolation expressions.

$ - string interpolation (C# reference)

String literals only exist in the source code. Anything you read from a database is a string object and cannot be a literal.

As you mentioned, you need to use conventional methods to manipulate the string's data (string.Format, regex, etc).

answered Apr 18, 2022 at 12:02

gunr2171

17.7k26 gold badges68 silver badges102 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

Manjay_TBAG Over a year ago

As if you would have placed {0}, {1} in database we could have use string.format without having string formed in code

Panagiotis Kanavos Over a year ago

@Manjay_TBAG what you ask is a bad idea in the first place. It leaves you open to SQL injections or simple coding errors. Don't construct SQL queries from strings (that includes string formatting) if possible

Panagiotis Kanavos Over a year ago

@Manjay_TBAG as for without having string formed in code but that's exactly what you're doing. String interpolation is still string construction in code. If take contained 1 ROWS ONLY; DROP TABLE Students;-- you'd end up with a query that dropped a table

Collectives™ on Stack Overflow

C# 7 string interpolation after reading string from database

1 Answer 1

3 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

3 Comments

Your Answer

Sign up or log in

Post as a guest

Related