Question

I need your advice. I’m writing an ASP.NET web application and I’m considering whether or not to allow users to specify search words in the database using regular expressions.

Two questions:

1. Does SQL Server support using regular expressions for SELECT statements?

2. Is it safe to allow users to specify regexps for database selection?

Answer 1

• 1 – No, but you may use CLR function for this, like:

  public partial class UserDefinedFunctions
  {
      [Microsoft.SqlServer.Server.SqlFunction(DataAccess = DataAccessKind.None, IsDeterministic = true)]
      public static SqlBoolean RegexMatch(string Pattern, string Expression)
      {
          return new Regex(Pattern).IsMatch(Expression);
      }
  };
  

• 2 – Safety completely depends on your realization