Regex to replace part of a query string with literals - c#

I have a slight problem in that I am passing several SQL Server Like queries (which I don't have control over) in my .Net application and I need to escape some of the characters to make them literals for the database.
For example, suppose the field I am trying to query looks something like:
This_is [a] long_text field with [literal] characters in it
And my query looks something like this:
SELECT * FROM [MyTable] where [MyField] Like 'This_% [literal]%'
Now, this should get that data, the challenge is that the _ and [ characters are not seen by SQL Server as the literal characters, so I have to update my query to:
SELECT * FROM [MyTable] where [MyField] Like 'This[_]% [[]literal]%'
And then it works.
So, my question is that I would like to write a VB.Net function that uses RegEx to find the Like part of the statement and then to replace the characters.
Something along the lines of:
Public Function ConvertQuery(strSQL as string)
... Some kind of Regex that searches for the word "Like"
and then takes everytihng between the 2 "'" characters
Then replaces the "_" with "[_]" and "[" with "[[]"
Return ChangedString
End Function
I know I am giving REALLY bad details, I know what i want, I just can't figure out how to do it with RegEx.
ALSO, if there is a smarter way to do this with SQL Server Like statments, please also let me know!!!
Thanks!!

Seeing that C# tag, I assume you are OK with an answer in C#.
string input = "This_is [a] long_text field with [literal] characters in it";
var output = Regex.Replace(input, #"[_\[]","[$0]");
EDIT
string input = "SELECT * FROM [MyTable] where [MyField] Like 'This_% [literal]'";
var output = Regex.Replace(input, #"(?<=Like[ ]*\'.+?)[_\[]", "[$0]");

Related

Removing whitespace in MSSQL and trailing spaces

I'm trying to remove whitespace and trailing white space from right and left side of my string in DB.
Note how the current results looklike:
Note the string named:
*excellent-purchase*
When I fetch it in my C# application like this:
ctx.Users.ToList();
The output for this string that I get is:
\t*excellent-purchase*
I need to remove this "\t" sign from my C# application either on DB level or inside the C# application.
The way I've tried it is like doing it is like this:
UPDATE
TableName
SET
ColumnName = LTRIM(RTRIM(ColumnName))
But I still get this \t sign in my C# app...
How can I fix this?
Edit:
guys I still have a weird characther like this:
"nl_holyland*555*
And in the C# App it looks like:
\"nl_holyland*555*
Theres an extra \ with this solution like
You can try it:
string value= Regex.Replace(value, #"\t|\n|\r", "");
You might want to try the following:
UPDATE
TableName
SET
ColumnName = LTRIM(RTRIM(REPLACE(ColumnName,char(9),'')))
You can use the Replace also:
UPDATE
TableName
SET
ColumnName = REPLACE(ColumnName, ' ', '')

Replacing single quotes in full sql queries with C#

In our C# desktop-application we generate a lot of dynamic sql-queries. Now we have some troubles with single quotes in strings. Here's a sample:
INSERT INTO Addresses (CompanyName) VALUES ('Thomas' Imbiss')
My question is: How can I find and replace all single quotes between 2 other single quotes in a string? Unfortunately I can't replace the single quotes when creating the different queries. I can only do that after the full query is created and right before the query gets executed.
I tried this pattern (Regular Expressions): "\w\'\w"
But this pattern doesn't work, because after "s'" there's a space instead of a char.
I am sorry to say, there is no solution in approach you expect.
For example, have these columns and values:
column A, value ,A',
column B, value ,B',
If they are together in column list, you have ',A',',',B','.
Now, where is the boundary between first and second value? It is ambiguous.
You must take action when creating text fields for SQL. Either use SQL parameters or properly escape qoutes and other problematic characters there.
Consider showing the above ambiguous example to managers, pushing the whole problem back as algorithmically unsolvable at your end. Or offer implementing a guess-work and ask them whether they will be happy if content of several text fields can get mixed in some cases like above one.
At time of SQL query creation, if they do not want to start using SQL parameters, the solution for enquoting any input string is as simple as replacing:
string Enquote(string input)
{
return input.All(c => Strings.AscW(c) < 128) ? "'" : "N'"
+ input.Replace("'", "''")
+ "'"
}
Of course, it can have problem with deliberately malformed Unicode strings (surrogate pairs to hide ') but it is not normally possible to produce these strings through the user interface. Generally this can be still faster than converting all queries to versions with SQL parameters.

Check if two Strings contain the same pattern

my application is going to need a string matching function between an inputed string and a string stored in my DB. Those strings concerns product dimensions (like length, heigh etc.) My goal is to check if the string inputed already exists in my database but maybe with another pattern , for example :
input : "vis 4*40" should return true if I have something like "vis 4X40" or "vis 4 x 40" or "vis 4* 40" in my database.
The only way i've found yet is to normalize my databse using a regexp to replace pattern like :
\d+ *[xX*] *\d+
with a normalized one (for example NumberXNumber), do the same with the string in input then try to find it. However I was wondering if any tool already existed and would allow me to do that. (I'm working in C# .NET V4)
A better way would be to concatenate both the data and then match them
string target=inputString+"#"+storedString;
if(Regex.IsMatch(target,"(\d+) *[xX*] *(\d+)#\1 *([xX*]) *\2"))
//the string is in the database
else
//it is not
Just use the user-provided wildcard, replace the * with % and query your table: SELECT col FROM table WHERE col LIKE 'vis 4%40'
Please make sure you execute your queries with parameters.

C# how to Parse stored procedure String

I have a Query string from client application. It comes with all parameters like
string query="PROCS.DBO.APP_2370_ANALYST_S 'ABC' , 'TESTDATA' , 100";
In Server, I made a function(Util.getParametersFromString) to parse string from client application to make parameter object Array using string.Split function.
I used ',' and ' ' as separator to make object array.
And I execute db procedure by using below code
object[] parameters = Util.getParametersFromString(query);
DbCommand cmd = dbconnection.GetStoredProcCommand("PROCS.DBO.APP_2370_ANALYST_S", parameters);
I works well if parameter string doesn't contain comma or single quotation mark.
If one of parameter string have one or more comma or single quotaion mark.
Like below
string query="PROCS.DBO.APP_2370_ANALYST_S 'A,B,C' , 'Hi, Sam 'The Legend' Brown was here ' , 100";
parameter array didn't come correctly. I didn't know how to parse string correctly in this
situation. Please give me advice to solve this problem
I am not good at english. So I am so sorry If I didn't write my question correctly
Regards,
Park
You can escape the single quotes - ' becomes '':
string query="PROCS.DBO.APP_2370_ANALYST_S 'A,B,C' , 'Hi, Sam ''The Legend'' Brown was here ' , 100";
As for the problem with a comma - it depends on how your function is written. You will have to escape the comma and make sure your function is aware of this escape sequence.
If both parameters of your query string are as flexible as your example, and you cannot change the way this string is generated as suggested in Oded's answer, you have a problem.
The query "PROCS.DBO.APP_2370_ANALYST_S 'ABC' , 'ABC' , 'ABC' , 100" for example, could be interpreted as having the first parameter "'ABC' , 'ABC'" and second parameter "ABC" or vice versa.
If, on the other hand, your first parameter may not contain 's, then you could identify the first parameter by looking between the first two 's, and the second parameter by falling between the third and the last '.

Multiline string literal in C#

Is there an easy way to create a multiline string literal in C#?
Here's what I have now:
string query = "SELECT foo, bar"
+ " FROM table"
+ " WHERE id = 42";
I know PHP has
<<<BLOCK
BLOCK;
Does C# have something similar?
You can use the # symbol in front of a string to form a verbatim string literal:
string query = #"SELECT foo, bar
FROM table
WHERE id = 42";
You also do not have to escape special characters when you use this method, except for double quotes as shown in Jon Skeet's answer.
It's called a verbatim string literal in C#, and it's just a matter of putting # before the literal. Not only does this allow multiple lines, but it also turns off escaping. So for example you can do:
string query = #"SELECT foo, bar
FROM table
WHERE name = 'a\b'";
This includes the line breaks (using whatever line break your source has them as) into the string, however. For SQL, that's not only harmless but probably improves the readability anywhere you see the string - but in other places it may not be required, in which case you'd either need to not use a multi-line verbatim string literal to start with, or remove them from the resulting string.
The only bit of escaping is that if you want a double quote, you have to add an extra double quote symbol:
string quote = #"Jon said, ""This will work,"" - and it did!";
As a side-note, with C# 6.0 you can now combine interpolated strings with the verbatim string literal:
string camlCondition = $#"
<Where>
<Contains>
<FieldRef Name='Resource'/>
<Value Type='Text'>{(string)parameter}</Value>
</Contains>
</Where>";
The problem with using string literal I find is that it can make your code look a bit "weird" because in order to not get spaces in the string itself, it has to be completely left aligned:
var someString = #"The
quick
brown
fox...";
Yuck.
So the solution I like to use, which keeps everything nicely aligned with the rest of your code is:
var someString = String.Join(
Environment.NewLine,
"The",
"quick",
"brown",
"fox...");
And of course, if you just want to logically split up lines of an SQL statement like you are and don't actually need a new line, you can always just substitute Environment.NewLine for " ".
One other gotcha to watch for is the use of string literals in string.Format. In that case you need to escape curly braces/brackets '{' and '}'.
// this would give a format exception
string.Format(#"<script> function test(x)
{ return x * {0} } </script>", aMagicValue)
// this contrived example would work
string.Format(#"<script> function test(x)
{{ return x * {0} }} </script>", aMagicValue)
Why do people keep confusing strings with string literals? The accepted answer is a great answer to a different question; not to this one.
I know this is an old topic, but I came here with possibly the same question as the OP, and it is frustrating to see how people keep misreading it. Or maybe I am misreading it, I don't know.
Roughly speaking, a string is a region of computer memory that, during the execution of a program, contains a sequence of bytes that can be mapped to text characters. A string literal, on the other hand, is a piece of source code, not yet compiled, that represents the value used to initialize a string later on, during the execution of the program in which it appears.
In C#, the statement...
string query = "SELECT foo, bar"
+ " FROM table"
+ " WHERE id = 42";
... does not produce a three-line string but a one liner; the concatenation of three strings (each initialized from a different literal) none of which contains a new-line modifier.
What the OP seems to be asking -at least what I would be asking with those words- is not how to introduce, in the compiled string, line breaks that mimick those found in the source code, but how to break up for clarity a long, single line of text in the source code without introducing breaks in the compiled string. And without requiring an extended execution time, spent joining the multiple substrings coming from the source code. Like the trailing backslashes within a multiline string literal in javascript or C++.
Suggesting the use of verbatim strings, nevermind StringBuilders, String.Joins or even nested functions with string reversals and what not, makes me think that people are not really understanding the question. Or maybe I do not understand it.
As far as I know, C# does not (at least in the paleolithic version I am still using, from the previous decade) have a feature to cleanly produce multiline string literals that can be resolved during compilation rather than execution.
Maybe current versions do support it, but I thought I'd share the difference I perceive between strings and string literals.
UPDATE:
(From MeowCat2012's comment) You can. The "+" approach by OP is the best. According to spec the optimization is guaranteed: http://stackoverflow.com/a/288802/9399618
Add multiple lines : use #
string query = #"SELECT foo, bar
FROM table
WHERE id = 42";
Add String Values to the middle : use $
string text ="beer";
string query = $"SELECT foo {text} bar ";
Multiple line string Add Values to the middle: use $#
string text ="Customer";
string query = $#"SELECT foo, bar
FROM {text}Table
WHERE id = 42";
You can use # and "".
string sourse = #"{
""items"":[
{
""itemId"":0,
""name"":""item0""
},
{
""itemId"":1,
""name"":""item1""
}
]
}";
In C# 11 [2022], you will be able to use Raw String literals.
The use of Raw String Literals makes it easier to use " characters without having to write escape sequences.
Solution for OP:
string query1 = """
SELECT foo, bar
FROM table
WHERE id = 42
""";
string query2 = """
SELECT foo, bar
FROM table
WHERE id = 42
and name = 'zoo'
and type = 'oversized "jumbo" grand'
""";
More details about Raw String Literals
See the Raw String Literals GitHub Issue for full details; and Blog article C# 11 Preview Updates – Raw string literals, UTF-8 and more!
I haven't seen this, so I will post it here (if you are interested in passing a string you can do this as well.) The idea is that you can break the string up on multiple lines and add your own content (also on multiple lines) in any way you wish. Here "tableName" can be passed into the string.
private string createTableQuery = "";
void createTable(string tableName)
{
createTableQuery = #"CREATE TABLE IF NOT EXISTS
["+ tableName + #"] (
[ID] INTEGER NOT NULL PRIMARY KEY AUTOINCREMENT,
[Key] NVARCHAR(2048) NULL,
[Value] VARCHAR(2048) NULL
)";
}
Yes, you can split a string out onto multiple lines without introducing newlines into the actual string, but it aint pretty:
string s = $#"This string{
string.Empty} contains no newlines{
string.Empty} even though it is spread onto{
string.Empty} multiple lines.";
The trick is to introduce code that evaluates to empty, and that code may contain newlines without affecting the output. I adapted this approach from this answer to a similar question.
There is apparently some confusion as to what the question is, but there are two hints that what we want here is a string literal not containing any newline characters, whose definition spans multiple lines. (in the comments he says so, and "here's what I have" shows code that does not create a string with newlines in it)
This unit test shows the intent:
[TestMethod]
public void StringLiteralDoesNotContainSpaces()
{
string query = "hi"
+ "there";
Assert.AreEqual("hithere", query);
}
Change the above definition of query so that it is one string literal, instead of the concatenation of two string literals which may or may not be optimized into one by the compiler.
The C++ approach would be to end each line with a backslash, causing the newline character to be escaped and not appear in the output. Unfortunately, there is still then the issue that each line after the first must be left aligned in order to not add additional whitespace to the result.
There is only one option that does not rely on compiler optimizations that might not happen, which is to put your definition on one line. If you want to rely on compiler optimizations, the + you already have is great; you don't have to left-align the string, you don't get newlines in the result, and it's just one operation, no function calls, to expect optimization on.
If you don't want spaces/newlines, string addition seems to work:
var myString = String.Format(
"hello " +
"world" +
" i am {0}" +
" and I like {1}.",
animalType,
animalPreferenceType
);
// hello world i am a pony and I like other ponies.
You can run the above here if you like.
using System;
namespace Demo {
class Program {
static void Main(string[] args) {
string str = #"Welcome User,
Kindly wait for the image to
load";
Console.WriteLine(str);
}
}
}
Output
Welcome User,
Kindly wait for the image to
load

Categories