Since EF Core does not currently execute group by queries in the database, I'm using the following query to get the job done (InvoiceQuery
is a DbQuery
type):
long merchantId = 177;
var invTokens = new List<string> {"qasas", "efsac"};
string inClause = string.Join(",", invTokens);
string query = $@"SELECT i.Token, i.Balance, COALESCE(SUM(i.Amount), 0) AS ProcessingAmount
FROM inv.Invoices i
WHERE i.Token IN ({inClause})
AND i.MerchantId = {merchantId}
AND i.Status = {(int)InvoiceStatus.Scheduled}
GROUP BY i.Token, i.Balance";
return await dbContext.InvoicesQuery.FromSql(query).ToListAsync();
The above code runs perfect but I don't like it because it gives me a warning of a 'Possible SQL injection vulnerability'.. I know I can use a #pragma
to suppress this warning (that's what I'm currently using).
I have tried passing the query and provide the params to the FromSql
method, and that works but the parameter that goes into the IN
clause is not getting correctly mapped..
Tried using $"'{string.Join("', '", invTokens)}'"
but it didn't work.
Any help would be appreciated
The above code runs perfect
I am honestly surprised the query runs successfully, given you aren't quoting the individualinClause
values. What is the exact value ofquery
at runtime? – mjwills Mar 26 '19 at 23:18