Ticket K18434
Visible to All Users

How to convert the CriteriaOperator to the corresponding filter string in order to use it for building SQL queries or for filtering the DataView

created 14 years ago (modified 5 months ago)

Description:
I wish to filter the DataView instance by using an active filter criteria of the grid or the FilterControl. Is there any way to convert the current filter expression to a valid one to filter the DataView?

Answer:
We use the DevExpress.Data.Filtering.CriteriaToWhereClauseHelper class for similar purposes. In simple cases, you can use CriteriaToWhereClauseHelper in your application as long this class suits your needs.

Please keep in mind that CriteriaToWhereClauseHelper is intended for internal purposes only. We neither provide any warranties/documentation nor have plans to add new features to this class in the future. Also, we cannot guarantee that it will not be changed in the future.

You can use the following methods to build SQL, Oracle, Access queries and to filter the DataView object:
- GetAccessWhere,
- GetDataSetWhere,
- GetDynamicLinqWhere,
- GetMsSqlWhere,
- GetOracleWhere
Below is an example illustrating how to filter the DataView object based upon an active filter criteria of the grid by using the static DevExpress.Data.Filtering.CriteriaToWhereClauseHelper.GetDataSetWhere method.

C#
CriteriaOperator op = gridView1.ActiveFilterCriteria; //filterControl1.FilterCriteria string filterString = DevExpress.Data.Filtering.CriteriaToWhereClauseHelper.GetDataSetWhere(op); dataView1.RowFilter = filterString;
Visual Basic
Dim op As CriteriaOperator = gridView1.ActiveFilterCriteria 'filterControl1.FilterCriteria Dim filterString As String = DevExpress.Data.Filtering.CriteriaToWhereClauseHelper.GetDataSetWhere(op) dataView1.RowFilter = filterString
Show previous comments (14)
Nadezhda (DevExpress Support) 7 years ago

    Hello Henry,

    I've created a separate ticket on your behalf ( How to use CriteriaToWhereClauseHelper in a MVC application ). It has been placed in our processing queue and will be answered shortly.

      I'm a bit late to the party but I just found this because I needed it.

      These methods are useless and I had to do it manually.
      The attached screenshot shows it:

      GetOracleWhere result

      "
      ""EVENT_DESCRIPTION"",
      ""contains"",
      ""asasasasasgg""
      "

      GetMsSqlWhere result (same as oracle)

      "
      ""EVENT_DESCRIPTION"",
      ""contains"",
      ""asasasasasgg""
      "

      GetDataSetWhere result (this is actually ok, but no use as sql statement)

      [
      "EVENT_DESCRIPTION",
      "contains",
      "asasasasasgg"
      ]

      Adding up to make it worse, the methods do not manage at all your own filter format which makes an array made of the filter, operator, filter, operator, and throws an error on the operator.
      To be more clear, the array of filters is on screenshot "filters.jpg".

      When you get to "and" and other operators, it throws exception. It should be care of the library to parse it.

      This forces you to parse different parts of the query and glue them togheter.

      In addition, which is even worse, what's coming from filters can be user free input, which is inevitable. This filter does not allow parametrization of the query and who writes in the filter can be a malicious actor putting malicious sql, causing sql injection.

      So:
      It doesn't produce valid sql.
      Even if it was, you have to glue it togheter and make if/else to catch operators.
      It's sql injection prone and does not allow to parametrize query.

      Practically speaking, do it by yourself (which is what I did) and you do a better job.
      I frankly don't get the sense of this part of the framework.

      DevExpress Support Team 3 years ago

        Hello Joshua,

        I created a separate ticket on your behalf: T1035768: How to use CriteriaToWhereClauseHelper . We placed it in our processing queue and will process it shortly.

        Disclaimer: The information provided on DevExpress.com and affiliated web properties (including the DevExpress Support Center) is provided "as is" without warranty of any kind. Developer Express Inc disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. Please refer to the DevExpress.com Website Terms of Use for more information in this regard.

        Confidential Information: Developer Express Inc does not wish to receive, will not act to procure, nor will it solicit, confidential or proprietary materials and information from you through the DevExpress Support Center or its web properties. Any and all materials or information divulged during chats, email communications, online discussions, Support Center tickets, or made available to Developer Express Inc in any manner will be deemed NOT to be confidential by Developer Express Inc. Please refer to the DevExpress.com Website Terms of Use for more information in this regard.