C# string replace with regex

Question

0.00/5 (No votes)

See more:

Hi,

I have text "FirstName = 'Mahesh' and Last Name ='Mohan'" , i want change the string to
"FirstName Like '%Mahesh%' and Last Name Like '%Mohan%'" how its possible using string.Replace

What I have tried:

I goolged it idint get any solution

Posted 5-Jun-18 20:45pm

Mahesh Alappuzha

Updated 11-Jun-18 2:56am

Add a Solution

Comments

Varun Sareen 6-Jun-18 3:05am

Why do you want to do this? If you can tell your problem then we can suggest better.

Mahesh Alappuzha 6-Jun-18 3:20am

i have some fixed rules in DB . i want execute these rules with some modification like my question

2 solutions

Solution 1

The only reason to do that is to concatenate a string to send it to SQL, and that's a very, very bad idea. You should never concatenate strings to build a SQL command. It leaves you wide open to accidental or deliberate SQL Injection attack which can destroy your entire database. Always use Parameterized queries instead.

When you concatenate strings, you cause problems because SQL receives commands like:

SQL

SELECT * FROM MyTable WHERE StreetAddress = 'Baker's Wood'

The quote the user added terminates the string as far as SQL is concerned and you get problems. But it could be worse. If I come along and type this instead: "x';DROP TABLE MyTable;--" Then SQL receives a very different command:

SQL

SELECT * FROM MyTable WHERE StreetAddress = 'x';DROP TABLE MyTable;--'

Which SQL sees as three separate commands:

SQL

SELECT * FROM MyTable WHERE StreetAddress = 'x';

A perfectly valid SELECT

SQL

DROP TABLE MyTable;

A perfectly valid "delete the table" command

SQL

--'

And everything else is a comment.
So it does: selects any matching rows, deletes the table from the DB, and ignores anything else.

So ALWAYS use parameterized queries! Or be prepared to restore your DB from backup frequently. You do take backups regularly, don't you?

So build your whole string differently:

SQL

... WHERE FirstName LIKE '%' + @FN + '%' AND LastName LIKE '%' + @LN + '%'

and pass the "Mahesh" and "Mohan" parts through via the parameters @FN and @LN respectively.

Posted 5-Jun-18 21:35pm

OriginalGriff

Comments

Mahesh Alappuzha 6-Jun-18 3:59am

i can't do it in DB . because almost 500 rules are there

OriginalGriff 6-Jun-18 4:04am

Sorry? Do you want to explain that while remembering that I can't see your screen and only get exactly what you type to work with?

Add a Solution

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

Maciej Los · Accepted Answer · 2018-06-11T02:58:00

Try this:

string s = @"FirstName = 'Mahesh' and Last Name ='Mohan'";

//find ending [']
string find2 = @"\b\s?'";
string replacement2 = "%'";
Regex r = new Regex(find2);
s=r.Replace(s, replacement2);

//find [=']
string find1 = @"=\s?'\b";
string replacement1 = @" Like '%";
r = new Regex(find1);
s= r.Replace(s, replacement1);

Console.WriteLine(s);

For further details, please see: Substitutions in Regular Expressions | Microsoft Docs[^]

C# string replace with regex

2 solutions

Solution 1

Solution 2

Add your solution here

Preview 0

C# string replace with regex

2 solutions

Solution 1

Solution 2

Add your solution here

Preview 0

Existing Members

...or Join us