Dapper: Result from “SELECT COUNT(*) FROM TableName

Please don’t do this! It’s fragile, and introduces a gaping sql injection vulnerability. If you can return your count for a given table with one line of very expressive code, and no vulnerability, why make it method?

Do this instead:

DapperConnection.ExecuteScalar<int>("SELECT COUNT(*) FROM customers");

// You will be happier and live longer if you avoid dynamically constructing 
// sql with string concat.

Leave a Comment

Hata!: SQLSTATE[HY000] [1045] Access denied for user 'divattrend_liink'@'localhost' (using password: YES)