Question

Is specifying a field name on middle-tier a leaky abstraction?

I feel it is too cumbersome to create a separate function just for each field, even if it is code-generated.

        public bool Assortment_IsValueExistingOnOtherRecord(             Dictionary<string, object> exceptPkColumns,             string field, object value             )         {             var c = Connect();              var dt = new DataTable();              string sanitizedField = field.Replace(''','');              var daAssortment = new SqlDataAdapter(                string.Format( @'SELECT 1 FROM assortment WHERE  /* do I violate any good programming practice here? */ [{0}] = @value  AND NOT (assortment_id = @assortment_id)',  field), c);              daAssortment.SelectCommand.Parameters.Add('assortment_id', exceptPkColumns['assortment_id']);             daAssortment.SelectCommand.Parameters.Add('value', value);             daAssortment.Fill(dt);              return dt.Rows.Count == 1;         }  

Answer 1

From an encapsulation perspective, there is nothing wrong with what you wrote.

However, as ‘David B’ alluded to (he was a little vauge about it), there are some security issues you need to be aware of.

The dynamic SQL you are generating is subject to something called a ‘SQL Injection attack’. Imagine, for example, that the value of field was the following string:

assortment_id] = 0 and assortment_id = 1  delete from assortment select 1 from assortment where [assortment_id 

this would result in the database executing 3 queries:

1. A dummy select query that brought back no results
2. A delete query that deleted everything in the assortment table
3. A real select query

That could, obviously, cause some problems.

If the value of ‘field’ is ever specified via:

1. A user interface field
2. A web page form submission
3. From a web service client
4. Loaded from a file on disk
5. Or in any way other than a constant value supplied by you in code

Then you need to validate the data to make sure it is a valid field value before running any queries. Otherwise you are vulnerable to attack.