Patterns Nonsense
So, I'm looking through the patterns stuff on Microsoft's site and I come across the MVC stuff. Man, they do some rediculously lame things when implementing these patterns. The patterns themselves are ok, it is their implementation that is just horrendous. For example:
public class DatabaseGateway
{
public static DataSet GetRecordings()
{
String selectCmd = "select * from Recording";
SqlConnection myConnection =
new SqlConnection(
"server=(local);database=recordings;Trusted_Connection=yes");
SqlDataAdapter myCommand = new SqlDataAdapter(selectCmd, myConnection);
DataSet ds = new DataSet();
myCommand.Fill(ds, "Recording");
return ds;
}
public static DataSet GetTracks(string recordingId)
{
String selectCmd =
String.Format(
"select * from Track where recordingId = {0} order by id",
recordingId);
SqlConnection myConnection =
new SqlConnection(
"server=(local);database=recordings;Trusted_Connection=yes");
SqlDataAdapter myCommand = new SqlDataAdapter(selectCmd, myConnection);
DataSet ds = new DataSet();
myCommand.Fill(ds, "Track");
return ds;
}
So, first off, whose idea was it not to use a parameterized queries? Even if it was an integer coming in, I would still question their absence, but this is a string based id coming in to this method. Way to go, you just opened up your site to the easiest hack in the book.
Secondly, who on the content team loves static methods? Come on. I thought these examples were supposed to illustrate best practices and such... guess I was mistaken.