问题
I have an ASP.NET 3.5 application that I want to allow the user to select a table and allow CRUD operations on that table. The user will be restricted to a number of tables to edit however the tables and even database won't be known until after deployment; the web.config will setup the connection and tables.
So I need to build a framework that will allow a generic table in a SQL database to be updated. Most of the ORMs I've seen require the schema to be known at compile time so I cannot use these. The best answer seems to be build the SQL query strings dynamically and use reg expressions to ensure valid input and protect against SQL injections. Is there a better way?
回答1:
Yes. How about dataset and datatable objects? you can populate these via a dynamic sql statement, bind them directly to a good editor grid control, and the schema and column data type checking should be a snap. What did we ever do before ORM's and Linq?!?!
回答2:
The Dynamic Linq Library is incredible. You can specify everything as a string, except maybe the table names.
(source: scottgu.com)
http://weblogs.asp.net/scottgu/archive/2008/01/07/dynamic-linq-part-1-using-the-linq-dynamic-query-library.aspx
However, look here for ideas on how to select tables at runtime by dynamically mapping the DataContext:
http://blogs.microsoft.co.il/blogs/bursteg/archive/2007/09/27/25294.aspx
来源：https://stackoverflow.com/questions/923907/dynamic-sql-for-updating-a-table-from-asp-net