DatabaseWrapper
Library | Version | Downloads |
---|---|---|
DatabaseWrapper (all supported database types) | ||
DatabaseWrapper.Mysql | ||
DatabaseWrapper.Postgresql | ||
DatabaseWrapper.Sqlite | ||
DatabaseWrapper.SqlServer | ||
DatabaseWrapper.Core |
DatabaseWrapper is the EASIEST and FASTEST way to get a data-driven application up and running using SQL Server, MySQL, PostgreSQL, or Sqlite.
For a sample app exercising this library, refer to the Test
project contained within the solution.
Core features:
- Dynamic query building
- Hierarchical Boolean logic using Expression objects
- Support for SQL server native vs Windows authentication
- Support for SELECT, INSERT, UPDATE, DELETE, TRUNCATE, CREATE, DROP or raw queries
- Programmatic table creation and removal (drop)
- Built-in sanitization
New in v3.1.0
- Breaking change: removal of .NET Framework and upgrade to .NET standard 2.1
- DatabaseSettings class
- New constructors
A Note on Sanitization
Use of parameterized queries vs building queries dynamically is a sensitive subject. Proponents of parameterized queries have data on their side - that parameterization does the right thing to prevent SQL injection and other issues. I do not disagree with them. However, it is worth noting that with proper care, you CAN build systems that allow you to dynamically build queries, and you SHOULD do so as long as you build in the appropriate safeguards.
If you find an injection attack that will defeat the sanitization layer built into this project, please let me know!
Simple Example
Refer to the test project for a more complete example with sample table setup scripts.
using DatabaseWrapper;
using DatabaseWrapper.Core;
DatabaseClient = null;
// Sqlite
client = new DatabaseClient("[databasefilename]");
// SQL Server, MySQL, or PostgreSQL
client = new DatabaseClient(DbTypes.SqlServer, "[hostname]", [port], "[user]", "[password]", "[databasename]");
client = new DatabaseClient(DbTypes.Mysql, "[hostname]", [port], "[user]", "[password]", "[databasename]");
client = new DatabaseClient(DbTypes.Postgresql, "[hostname]", [port], "[user]", "[password]", "[databasename]");
// SQL Express
client = new DatabaseClient(DbTypes.SqlServer, "[hostname]", [port], "[user]", "[password]", "[instance]", "[databasename]");
// some variables we'll be using
Dictionary<string, object> d;
Expression e;
List<string> fields;
DataTable result;
// add a record
d = new Dictionary<string, object>();
d.Add("firstName", "Joel");
d.Add("lastName", "Christner");
d.Add("notes", "Author");
result = client.Insert("person", d);
// update a record
d = new Dictionary<string, object>();
d.Add("notes", "The author :)");
e = new Expression("firstName", Operators.Equals, "Joel");
result = client.Update("person", d, e);
// retrieve 10 records
fields = new List<string> { "firstName", "lastName" }; // leave null for *
e = new Expression("lastName", Operators.Equals, "Christner");
result = client.Select("person", 0, 10, fields, e, "ORDER BY personId ASC");
// delete a record
e = new Expression("firstName", Operators.Equals, "Joel");
result = client.Delete("person", e);
// execute a raw query
result = client.RawQuery("SELECT customer_id FROM customer WHERE customer_id > 10");
Sample Compound Expression
Expressions can be nested in either the LeftTerm or RightTerm. Conversion from Expression to a WHERE clause uses recursion, so you should have a good degree of flexibility in building your expressions in terms of depth.
Expression e = new Expression {
LeftTerm = new Expression("age", Operators.GreaterThan, 30),
Operator = Operators.And,
RightTerm = new Expression("height", Operators.LessThan, 74)
};
Select with Pagination
Use indexStart, maxResults, and orderByClause to retrieve paginated results. The query will retrieve maxResults records starting at row number indexStart using an ordering based on orderByClause. See the example in the DatabaseWrapperTest project.
IMPORTANT: When doing pagination, you MUST specify an orderByClause
.
DataTable result = client.Select("person", 5, 10, null, e, "ORDER BY age DESC");
Need a Timestamp?
We added a simple static method for this which you can use when building expressions (or elsewhere). An object method exists as well.
string SqlServer1 = DatabaseClient.DbTimestamp(DbTypes.SqlServer, DateTime.Now));
string SqlServer2 = client.Timestamp(DateTime.Now);
// 08/23/2016 05:34:32.4349034 PM
string mysql1 = DatabaseClient.DbTimestamp(DbTypes.MySql, DateTime.Now));
string mysql2 = client.Timestamp(DateTime.Now);
// 2016-08-23 17:34:32.446913
Other Notes
General
When using database-specific classes DatabaseWrapper.Mysql
, DatabaseWrapper.Postgresql
, DatabaseWrapper.SqlServer
, or DatabaseWrapper.Sqlite
, the constructor is simplified from what is shown above.
For Sqlite:
DatabaseClient client = new DatabaseClient("[databasefilename]");
For SQL Server, MySQL, or PostgreSQL:
DatabaseClient client = new DatabaseClient(DbTypes.SqlServer, "[hostname]", [port], "[user]", "[password]", "[databasename]");
DatabaseClient client = new DatabaseClient(DbTypes.Mysql, "[hostname]", [port], "[user]", "[password]", "[databasename]");
DatabaseClient client = new DatabaseClient(DbTypes.Postgresql, "[hostname]", [port], "[user]", "[password]", "[databasename]");
For SQL Express:
DatabaseClient client = new DatabaseClient(DbTypes.SqlServer, "[hostname]", [port], "[user]", "[password]", "[instance]", "[databasename]");
MySQL
- MySQL does not like to return updated rows. I thought about making the UPDATE clause require that you supply the ID field and the ID value so that I could retrieve it after the fact, but that approach is just too limiting.
PostgreSQL
- Cleansing of strings in PostgreSQL uses the dollar-quote style. Fieldnames are always encapsulated in double-quotes for PostgreSQL.
Sqlite
- Sqlite has only shown to work well with .NET Core and not .NET Framework. If you have a solution for making it work more reliably with .NET Framework, please let me know.
Version history
Refer to CHANGELOG.md.