1

I am doing silver-light app which is really new to me.

Is it possible retrieve data by passing queries as String to wcf and retrieve the data from the db.

The query (not linq) could be anything.. like select x,y,z from A where a=.. or select Distinct name from x...

Basically a function which should take string query and retrieve it.

benRollag
  • 1,219
  • 4
  • 16
  • 21
pheonix4eva
  • 317
  • 1
  • 8
  • 25

2 Answers2

5

It is possible, but don't do this.

It's a great security risk: anyone running the Silverlight app could be able to sniff the traffic going out from the app to the WCF service and see that one of the parameters is in fact an SQL query.

Also, the request could be tampered with, which would potentially give users access to run arbitrary queries on your database.

Cristian Lupascu
  • 39,078
  • 16
  • 100
  • 137
3

Yes it is possible. Create a WCF method that accepts a string which is the query. For the return type, you probably have to do some more work to make it manageable. Probably you need some kind of collection of DTO objects, which requires either a very flexible design of the DTO objects or limitations on the allowed result set of the query.

There is a discussion on returning datasets/datatables from a web service in the Can I serialize a Data Table or Data Set to transfer over a Web Service in C#? SO question.

As @w0lf points out, there can be severe security risks that you must take into consideration. What you will be doing is to give anyone with access to your WCF service access to run arbitrary queries on your SQL server. It can be done safely, if you run those queries under a specific account on the SQL server with carefully crafted permissions. See e.g. http://data.stackexchange.com that permits SQL queries to be run - with a read-only user.

Generally I think that it is a bad idea to supply queries as strings, but if you really neeed it, it is indeed possible.

Community
  • 1
  • 1
Anders Abel
  • 67,989
  • 17
  • 150
  • 217