New Community Website

Ordinarily, you'd be at the right spot, but we've recently launched a brand new community website... For the community, by the community.

Yay... Take Me to the Community!

The Community Blog is a personal opinion of community members and by no means the official standpoint of DNN Corp or DNN Platform. This is a place to express personal thoughts about DNNPlatform, the community and its ecosystem. Do you have useful information that you would like to share with the DNN Community in a featured article or blog? If so, please contact community@dnnsoftware.com.

The use of the Community Blog is covered by our Community Blog Guidelines - please read before commenting or posting.

Use DAL+ ExecuteSQL for truly rapid DotNetNuke® Module development

Jan 19

Comments (8), Permalink

Using the ExecuteSQL method of the DotNetNuke Data Access Layer allows you to quickly and easily create DotNetNuke modules that access the database.

SQL vs. Stored Procedures

I love stored procedures as much as the next developer and have used them for years. However, during development I use the ExecuteSQL method of the DAL+ to initially create the module and later I turn the SQL statements into stored procedures.

The ExecuteSQL code looks like this (note: I am not using a data provider class for brevity):

Dim mySqlString As New StringBuilder()
mySqlString.Append("SELECT * From DesktopModules")
Me.GridView1.DataSource = CType(DataProvider.Instance().ExecuteSQL(mySqlString.ToString()), IDataReader)
Me.GridView1.DataBind()

This allows truly rapid DotNetNuke Module development. There are cases where I would like to leave the code as SQL statements but previously I didn't because of two factors:

Risk of SQL Injection attacks
Supporting the {databaseOwner} and {objectQualifier} features of the DotNetNuke framework

While researching another issue I ran across this code in the DotNetNuke Core that solves both of those problems:

This is an overloaded function of the ExecuteSQL method and it addresses the two previous concerns. I altered my Super Simple DAL+ Tutorial to use code like this:

Dim mySqlString As New StringBuilder()

mySqlString.Append("SELECT FriendlyName, Description ")
mySqlString.Append("FROM {databaseOwner}{objectQualifier}DesktopModules ")
mySqlString.Append("WHERE Description like '%' + @SearchString + '%' ")
mySqlString.Append("ORDER BY FriendlyName")

Dim myParam As SqlParameter = New SqlParameter("@SearchString", SqlDbType.VarChar, 150)
myParam.Value = SearchString

Me.GridView1.DataSource = CType(DataProvider.Instance().ExecuteSQL(mySqlString.ToString(), myParam), IDataReader)
Me.GridView1.DataBind()

Even if you decide to use stored procedures, the ExecuteSQL method will allow you to quickly create your module because you wont have to create the stored procedures until the final step. When you do create the stored procedures, you will be able to cut and paste most of the code.

If you decide to use the ExecuteSQL statements in production, you will only need database scripts to create and alter your tables. If you use ANSI compatible SQL syntax your module should also work with alternate databases such as Oracle and MySQL.

In addition, remember, The DAL+ is not just ExecuteSQL. It consists of 4 methods:

ExecuteNonQuery - Used to execute a stored procedure that will not return a value.
ExecuteReader - Used to execute a stored procedure that will return multiple records.
ExecuteScalar - Used to execute a stored procedure that will return a single value.
ExecuteSQL - Used to execute a sql statement.

Published: January 19, 2007
By: Michael Washington

Comments

Comment Form

Only registered users may post comments.

Products

Solutions

Resources

Partners

Community

About

New Community Website

Use DAL+ ExecuteSQL for truly rapid DotNetNuke® Module development

SQL vs. Stored Procedures

Comments

Comment Form

NewsArchives

ESW Operations, LLC