Chat room questions from the EF Tips & Tricks webcast

Thanks to a number of attendees for answering lots of questions by others while I was presenting yesterday. John Angelino seems to really have answered a lot.

I thought I would highlight some of them.
 

Q: v1 to v4? Where's v2 and v3?

A Microsoft is syncing the versions to match .Net 4 (Dane Morgridge)

Q: is it going to be either/or, or is the foreign key going to be a scaler value and we'll still have the navigation properties?

A: With EF4, when you build a model with the Foreign Key support, you will have the scalar value AND the navigation properties.

 

I used LINQPad in my demo and saw these comments:

  LINQPad is at http://www.linqpad.net/  (Richard Hough)

...and well worth the 20 bucks US for the INtellisense so buy it! (John Angelini )

Agreed!

 

URL for ADO.NET Team is http://blogs.msdn.com/adonet

 

Many questions about SQL Injection when concatenating Entity SQL strings.

1) you can use ObjectParameters with Object Query

2) ESQL is a query against the model, not against the database. It would be very hard to write a valid ESQL command with a SQL injection. It is possible for an Entity SQL injection however, so you should use similar precautions as you do with any other query.

Also about SQL Injection with LINQ to Entities

If you are using variables as parameters with LINQ to Entities,

String myvar=”Lerman”;

IQueryable<Contact> contacts=from c in context.Contacts where c.LastName==myvar select c;

EF will build a parameterized SQL query so you don’t risk SQL Injection.

If you just embed the parameter directly,

IQueryable<Contact> contacts=from c in context.Contacts where c.LastName==”Lerman” select c;

there is no need and EF will just build a regular query without parameters.

 

Q: I program in vb is there better way to get a single record and bind to fields without using "For Each"? ta

I used foreach/For Each in my examples to simply examine the data. You can definitely use entity objects with databinding whether you are using WinForms, WPF or ASP.NET.

A: Zak, you can use the .First() or .FirstOrDefault() methods on the entity set. Ex: var v = context.Orders.Where(p=>p.someprop=="something").FirstOrDefault().

This will return a single object or null if no matching object exists...just pivot it to VB (John Angelini )

Q: (well just a point) Should not use "throw ex", discards stack trace.

A: I know, it was a lazy-ass thing to do for a demo (and was not a lesson on exception handling). But even in little sample snippets it’s bad for presenters to show bad  coding practices. But geeze – it’s demo ware. I’ll clean it up next time. :)

 

Q: Can we update the model from the database, without having to delete it and re-add it?

A: Absolutely. There is a feature in the designer called “Update Model from Database” I will not harm your model but if you have made any manual changes to the SSDL those will be overwritten. There are subtle things to watch out for. New tables/sprocs/views that you select will be added to the model. New fields in an existing table will be added. Existing entity properties that are mapped to a field which was deleted will still be in the model but will not be mapped to anything and will throw an error. You will need to manually delete those properties. If you change the TYPE of a database field, the property mapped to that field will not change it’s type. You’ll have to do that manually.

Q: If I am totally new to EF, and don't have an immediate need to ship, should I bother with VS2008/EF1, or should I start with VS2010/EF4? Is 2010/EF4 relatively stable (for a beta)?

A: VS2010!!

I’ll write another blog post as soon as I get the deck and demos up on my website and also when I have the link for the recording (which will be available sometime next week, I’ve been told).

Thanks for attending!

#1 Daniel Simmons on 8.28.2009 at 12:44 PM

About esql injection, another thing that can help a lot there is to use the ObjectQuery builder methods which take small fragments of esql and help to build up a query in a safe way (that's what those methods were designed to help with).

#2 JLesch on 8.31.2009 at 1:20 PM

> IQueryable<Contact> contacts=from c in context.Contacts where c.LastName==”Lerman” select c;

In this case you have a hardcoded value in code. Could you post a case where you are accepting user input but still end up with a non-parameterized query?

#3 Julie on 8.31.2009 at 1:34 PM

@jlesch

Not with LINQ to Entities.

With ESQL you could build a string

"SELECT c from MyEntities.COntacts as c WHERE c.LastName=" + myvar

Then you won't get a paramterized query in the db.

Just remember that is ESQL not TSQL. It is not sent diretly and most sql injection attempts will render the ESQL invalid anyway.

(Plus you *can* use ObjectParameters rather than bulid up a concatenated string)

julie

#4 JLesch on 8.31.2009 at 2:17 PM

Got it. thanks.

#5 Kevin Carroll on 8.31.2009 at 2:40 PM

Julie,

In your presentation, you mentioned that all of the sample code would be made available for download. Is this the place to look for it? If so, when can we expect it.

Thanks,

Kevin

#6 Julie on 8.31.2009 at 2:46 PM

@Kevin:

I've put it up on my site at learnentityframework.com/downloads but was waiting for the url of the recorded presentation before blogging.