将字符串查询传递给 wcf 并从 db 检索数据
我正在做 silver-light 应用程序，这对我来说真的很新。
是否可以通过将查询作为字符串传递给 wcf 来检索数据并从数据库中检索数据。
查询（不是 linq）可以是任何东西..比如 select x,y,z from A where a=.. 或选择 Distinct name from x...
基本上是一个应该进行字符串查询并检索它的函数。
I am doing silver-light app which is really new to me.
Is it possible retrieve data by passing queries as String to wcf and retrieve the data from the db.
The query (not linq) could be anything.. like select x,y,z from A where a=..
or select Distinct name from x...
Basically a function which should take string query and retrieve it.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
这是可能的，但不要这样做。
这是一个很大的安全风险：任何运行 Silverlight 应用程序的人都可以嗅探从应用程序到 WCF 服务的流量，并发现其中一个参数实际上是 SQL 查询。
此外，请求可能会被篡改，这可能会让用户有权在您的数据库上运行任意查询。
It is possible, but don't do this.
It's a great security risk: anyone running the Silverlight app could be able to sniff the traffic going out from the app to the WCF service and see that one of the parameters is in fact an SQL query.
Also, the request could be tampered with, which would potentially give users access to run arbitrary queries on your database.
是的，这是可能的。创建一个接受作为查询的
字符串的WCF方法。对于返回类型，您可能需要做更多的工作才能使其易于管理。您可能需要某种类型的 DTO 对象集合，这需要非常灵活的 DTO 对象设计或对允许的查询结果集进行限制。我可以序列化数据表或数据集以通过 C# 中的 Web 服务传输吗？ SO 问题。
正如 @w0lf 指出的，您必须考虑可能存在严重的安全风险。您要做的就是授予任何有权访问您的 WCF 服务的人在您的 SQL 服务器上运行任意查询的权限。如果您使用精心设计的权限在 SQL Server 上的特定帐户下运行这些查询，则可以安全地完成此操作。请参阅例如 http://data.stackexchange.com ，它允许运行 SQL 查询 - 使用只读用户。
一般来说，我认为以字符串形式提供查询是一个坏主意，但如果你真的需要它，它确实是可能的。
Yes it is possible. Create a WCF method that accepts a
stringwhich is the query. For the return type, you probably have to do some more work to make it manageable. Probably you need some kind of collection of DTO objects, which requires either a very flexible design of the DTO objects or limitations on the allowed result set of the query.There is a discussion on returning datasets/datatables from a web service in the Can I serialize a Data Table or Data Set to transfer over a Web Service in C#? SO question.
As @w0lf points out, there can be severe security risks that you must take into consideration. What you will be doing is to give anyone with access to your WCF service access to run arbitrary queries on your SQL server. It can be done safely, if you run those queries under a specific account on the SQL server with carefully crafted permissions. See e.g. http://data.stackexchange.com that permits SQL queries to be run - with a read-only user.
Generally I think that it is a bad idea to supply queries as strings, but if you really neeed it, it is indeed possible.