Dynamic LINQ with direct user input, any dangers?
问题 I have a table in a ASP.NET MVC application that I want to be sortable (serverside) and filterable using AJAX. I wanted it to be fairly easy to use in other places and didn't feel like hardcoding the sorting and filtering into query expressions so I looked for a way to build the expressions dynamically and the best way to do this I found was with Dynamic LINQ. User input from a URL like below is directly inserted into a dynamic Where or OrderBy. /Orders?sortby=OrderID&order=desc&CustomerName