We are considering using the Dynamic.CS linq-sample included in the "Samples" directory of visual studio 2008 for our WebAPI project to allow clients to query our data.

The interface would be something like this (In addition to the normal GET-methods):

public HttpResponseMessage List(string filter = null);

The plan is to use the dynamic library to parse the "filter"-variable and then execute the query agains the DB. Any thoughts if this is a good idea? Is it a security problem?

  • 1
    Why not use data binding out of the box? Also if you choose to use Dynamic.CS your tests will become cluttered as you would have to transform string to a query prior to testing anything that actually needs to be tested. – CodeART Oct 14 '13 at 7:05

We implement it a bit differently right now.

We introduced Filter classes and filter Processors.
Filter processor takes intstance of the filter and converts it to expression of type Expression<Func<FilteredEntityType,bool>> which is then used as parameter of Where in Repository.

At the stage of processing the filter you can introduce some complex logic which concerns access rights for instance.

It's also viable to process OData query against exposed DTOs and convert it corresponding POCO filtering query. But it's a bid harder to wotk with expression trees rather class.

Here is one of our filters:

public class ProductFilter
    public int? ProductId { get; set; }

    public int? VendorId { get; set; }

    public string VendorNameEquals { get; set; }

    public int? ProductTypeId { get; set; }

    public string NameContains { get; set; }

    public string NameEquals { get; set; }

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.