Use DAL+ ExecuteSQL for truly rapid DotNetNuke® Module development

Also see:

Using the ExecuteSQL method of the DotNetNuke Data Access Layer allows you to quickly and easily create DotNetNuke modules that access the database.

SQL vs. Stored Procedures

I love stored procedures as much as the next developer and have used them for years. However, during development I use the ExecuteSQL method of the DAL+ to initially create the module and later I turn the SQL statements into stored procedures.

The ExecuteSQL code looks like this (note: I am not using a data provider class for brevity):

Dim mySqlString As New StringBuilder()
mySqlString.Append("SELECT * From DesktopModules")
Me.GridView1.DataSource = CType(DataProvider.Instance().ExecuteSQL(mySqlString.ToString()), IDataReader)
Me.GridView1.DataBind()

This allows truly rapid DotNetNuke Module development. There are cases where I would like to leave the code as SQL statements but previously I didn't because of two factors:

• Risk of SQL Injection attacks
• Supporting the {databaseOwner} and {objectQualifier} features of the DotNetNuke framework

While researching another issue I ran across this code in the DotNetNuke Core that solves both of those problems:

This is an overloaded function of the ExecuteSQL method and it addresses the two previous concerns. I altered my Super Simple DAL+ Tutorial to use code like this:

Dim mySqlString As New StringBuilder()

mySqlString.Append("SELECT FriendlyName, Description ")
mySqlString.Append("FROM {databaseOwner}{objectQualifier}DesktopModules ")
mySqlString.Append("WHERE Description like '%' + @SearchString + '%' ")
mySqlString.Append("ORDER BY FriendlyName")

Dim myParam As SqlParameter = New SqlParameter("@SearchString", SqlDbType.VarChar, 150)
myParam.Value = SearchString

Me.GridView1.DataSource = CType(DataProvider.Instance().ExecuteSQL(mySqlString.ToString(), myParam), IDataReader
Me.GridView1.DataBind()

Even if you decide to use stored procedures, the ExecuteSQL method will allow you to quickly create your module because you wont have to  create the stored procedures until the final step. When you do create the stored procedures, you will be able to cut and paste most of the code.

If you decide to use the ExecuteSQL statements in production, you will only need database scripts to create and alter your tables. If you use ANSI compatible SQL syntax your module should also work with alternate databases such as Oracle and MySQL.

In addition, remember, The DAL+ is not just ExecuteSQL. It consists of 4 methods:

• ExecuteNonQuery - Used to execute a stored procedure that will not return a value.
• ExecuteReader - Used to execute a stored procedure that will return multiple records.
• ExecuteScalar - Used to execute a stored procedure that will return a single value.
• ExecuteSQL - Used to execute a sql statement.

Developing Your Own DotNetNuke Module

To develop your own DotNetNuke modules, it is recommended that you follow these tutorials in this order:

• Super-Simple Module (DAL+)
• Super-Fast Super-Easy Module (DAL+)
• Create a full complete Module

[Back to: The ADefWebserver DotNetNuke HELP WebSite]

DotNetNuke® is a registered trademark of Perpetual Motion Interactive Systems Inc.