Question

I`d like to implement a feature, that will allow user to type something like this:

"select * from products where low(price);" 

what is equal to:

"select * from products where (price >=0) And (price <= 50);"

do you maybe know any solutions that will be useful for me ? My second question is where in the application structure should I transform it ? In the application code or somehow in the database ?

My app is written in C# and connects to SQL Server 2008 via ADO.NET.

I would be very greatful for any hints, pseudocode, etc.

Thanks in advance !

Answer 1

SQL Server allows you to define user-defined functions (see for example this article). If you defined a function low then the first code you wrote would be a perfectly valid SQL query and you wouldn’t need to do any pre-processing at all. The declaration would look roughly like this:

 CREATE FUNCTION low(@price)
 RETURNS boolean AS
 BEGIN
   RETURN (@price >= 0) AND (@price <= 50)
 END

If you want to allow more fuzzy language than just function calls, then that would be another (and significantly more complicated) problem. I’m not aware of any library that does that and implementing that yourself could be quite a challange. (You may want to add more examples, so that we can see what you mean).

Of course, if you allow the user to write raw SQL queries, the user should be someone you can trust (because they can easily drop all data from your database).