1

I'm trying to query the Microsoft Indexing Service catalog, and I've found a bunch of really helpful articles about it (like this one), but every example I find they just use string concatenation to build queries, and it feels so wrong on so many different levels.

I clearly want to use parameterized queries, but it looks like the MS Indexing provider doesn't support them, as described by the following exception:

The ICommandWithParameters interface is not supported by the 'MSIDXS' provider. Command parameters are unsupported with the current provider.

Here's a simplified example of my code. All I want to do is run a really simple query, and protect against bad input.

OleDbCommand cmd = new OleDbCommand("select DocTitle, Path from scope() where @friendlyName = '@value'", ActiveConnection());
cmd.Parameters.Add(new OleDbParameter("@friendlyName", friendlyName));
cmd.Parameters.Add(new OleDbParameter("@value", value));

OleDbDataAdapter da = new OleDbDataAdapter(cmd);
DataSet results = new DataSet();
da.Fill(results);

If I'm really forced to use string concatenation, what's the best way to sanitize the inputs? How will I know I covered all the cases?

wsanville
  • 37,158
  • 8
  • 76
  • 101
  • did you tried without **OleDbParameter** ? – Kiquenet Jun 09 '16 at 12:55
  • try `cmd.CommandText = string.Format(@"select Rank,HitCount,Filename,Size,Write,PATH,Directory,DocAppName,DocCategory,DocKeywords from Scope() where CONTAINS ( '{0}') order by Rank desc,WRITE desc", txtQueryText.Text.Trim());` – Kiquenet Jun 09 '16 at 13:00

1 Answers1

0

Do the parameters have to have names? Looks like this msdn example might fit the bill.

public void CreateMyOleDbCommand(OleDbConnection connection,
string queryString, OleDbParameter[] parameters) {
OleDbCommand command = new OleDbCommand(queryString, connection);
command.CommandText = 
    "SELECT CustomerID, CompanyName FROM Customers WHERE Country = ? AND City = ?";
command.Parameters.Add(parameters);

for (int j=0; j<parameters.Length; j++)
{
    command.Parameters.Add(parameters[j]) ;
}

string message = "";
for (int i = 0; i < command.Parameters.Count; i++) 
{
    message += command.Parameters[i].ToString() + "\n";
}
Console.WriteLine(message);

}

http://msdn.microsoft.com/en-us/library/system.data.oledb.oledbcommand.parameters.aspx

Dan McNamara
  • 301
  • 1
  • 7
  • haha what's up DMAC. To answer your question, no, my parameters do not need to be named. I tried using the ? syntax and it still throws, I guess I can't use parameters of any kind here... Any ideas how to escape the inputs manually (yuck)? – wsanville Oct 15 '10 at 14:49