Question 1

How to secure dynamic LINQ queries against injection attacks?

Accepted Answer

Use parameterized placeholders (@0, @1) in string expressions and leverage security configs like RestrictOrderByToPropertyOrField. Avoid concatenating user input directly into query strings to prevent vulnerabilities.

Question 2

System.Linq.Dynamic.Core vs building Expression trees manually: which is better?

Accepted Answer

Manual Expression trees offer better performance and type safety for fixed queries, while System.Linq.Dynamic.Core simplifies dynamic scenarios at the cost of runtime parsing. Choose based on your need for flexibility versus optimization.

Question 3

How to use interpolated strings with dynamic LINQ in .NET Core?

Accepted Answer

On .NET Core 2.1+, call methods like WhereInterpolated with interpolated strings, e.g., db.Customers.WhereInterpolated($"City == {cityName}"). Ensure your framework version supports it as per the README.

Question 4

What are the main breaking changes in recent versions?

Accepted Answer

Versions like 1.6.0 restrict method calls on object types and limit OrderBy to properties/fields by default for security. To revert, adjust ParsingConfig settings such as AllowEqualsAndToStringMethodsOnObject.

Question 5

Can I use System.Linq.Dynamic.Core with Dapper or other ORMs?

Accepted Answer

Yes, it works with any IQueryable source, so you can apply it to Dapper results converted to IQueryable. For enhanced integration, consider companion NuGet packages like Z.DynamicLinq.SystemTextJson.

Question 6

How to allow calling methods on my custom classes in dynamic queries?

Accepted Answer

Annotate the class with [DynamicLinqType] attribute or implement a custom TypeProvider set in ParsingConfig. This is mandatory due to security restrictions from v1.3.0 onwards.

System.Linq.Dynamic.Core

What is System.Linq.Dynamic.Core?

Overview

Use Cases

Best For

Related Projects

Found a gem we're missing?

Not Ideal For

Pros & Cons

Pros

Cons

Frequently Asked Questions