Database.ExecuteSqlCommand Method
Definition
Important
Some information relates to prerelease product that may be substantially modified before it’s released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
Overloads
| ExecuteSqlCommand(String, Object[]) |
Executes the given DDL/DML command against the database. As with any API that accepts SQL it is important to parameterize any user input to protect against a SQL injection attack. You can include parameter place holders in the SQL query string and then supply parameter values as additional arguments. Any parameter values you supply will automatically be converted to a DbParameter. context.Database.ExecuteSqlCommand("UPDATE dbo.Posts SET Rating = 5 WHERE Author = @p0", userSuppliedAuthor); Alternatively, you can also construct a DbParameter and supply it to SqlQuery. This allows you to use named parameters in the SQL query string. context.Database.ExecuteSqlCommand("UPDATE dbo.Posts SET Rating = 5 WHERE Author = @author", new SqlParameter("@author", userSuppliedAuthor)); |
| ExecuteSqlCommand(TransactionalBehavior, String, Object[]) |
Executes the given DDL/DML command against the database. As with any API that accepts SQL it is important to parameterize any user input to protect against a SQL injection attack. You can include parameter place holders in the SQL query string and then supply parameter values as additional arguments. Any parameter values you supply will automatically be converted to a DbParameter. context.Database.ExecuteSqlCommand("UPDATE dbo.Posts SET Rating = 5 WHERE Author = @p0", userSuppliedAuthor); Alternatively, you can also construct a DbParameter and supply it to SqlQuery. This allows you to use named parameters in the SQL query string. context.Database.ExecuteSqlCommand("UPDATE dbo.Posts SET Rating = 5 WHERE Author = @author", new SqlParameter("@author", userSuppliedAuthor)); |
ExecuteSqlCommand(String, Object[])
Executes the given DDL/DML command against the database.
As with any API that accepts SQL it is important to parameterize any user input to protect against a SQL injection attack. You can include parameter place holders in the SQL query string and then supply parameter values as additional arguments. Any parameter values you supply will automatically be converted to a DbParameter. context.Database.ExecuteSqlCommand("UPDATE dbo.Posts SET Rating = 5 WHERE Author = @p0", userSuppliedAuthor); Alternatively, you can also construct a DbParameter and supply it to SqlQuery. This allows you to use named parameters in the SQL query string. context.Database.ExecuteSqlCommand("UPDATE dbo.Posts SET Rating = 5 WHERE Author = @author", new SqlParameter("@author", userSuppliedAuthor));
public int ExecuteSqlCommand (string sql, params object[] parameters);member this.ExecuteSqlCommand : string * obj[] -> intPublic Function ExecuteSqlCommand (sql As String, ParamArray parameters As Object()) As IntegerParameters
- sql
- String
The command string.
- parameters
- Object[]
The parameters to apply to the command string.
Returns
The result returned by the database after executing the command.
Remarks
If there isn't an existing local or ambient transaction a new transaction will be used to execute the command.
Applies to
ExecuteSqlCommand(TransactionalBehavior, String, Object[])
Executes the given DDL/DML command against the database.
As with any API that accepts SQL it is important to parameterize any user input to protect against a SQL injection attack. You can include parameter place holders in the SQL query string and then supply parameter values as additional arguments. Any parameter values you supply will automatically be converted to a DbParameter. context.Database.ExecuteSqlCommand("UPDATE dbo.Posts SET Rating = 5 WHERE Author = @p0", userSuppliedAuthor); Alternatively, you can also construct a DbParameter and supply it to SqlQuery. This allows you to use named parameters in the SQL query string. context.Database.ExecuteSqlCommand("UPDATE dbo.Posts SET Rating = 5 WHERE Author = @author", new SqlParameter("@author", userSuppliedAuthor));
public int ExecuteSqlCommand (System.Data.Entity.TransactionalBehavior transactionalBehavior, string sql, params object[] parameters);member this.ExecuteSqlCommand : System.Data.Entity.TransactionalBehavior * string * obj[] -> intParameters
- transactionalBehavior
- TransactionalBehavior
Controls the creation of a transaction for this command.
- sql
- String
The command string.
- parameters
- Object[]
The parameters to apply to the command string.
Returns
The result returned by the database after executing the command.
Applies to
Entity Framework