Example #1
0
        // To protect from overposting attacks, enable the specific properties you want to bind to.
        // For more details, see https://aka.ms/RazorPagesCRUD.
        public async Task <IActionResult> OnPostAsync()
        {
            if (!ModelState.IsValid)
            {
                return(Page());
            }

            _context.Attach(Employee).State = EntityState.Modified;

            try
            {
                await _context.SaveChangesAsync();
            }
            catch (DbUpdateConcurrencyException)
            {
                if (!EmployeeExists(Employee.EmployeeId))
                {
                    return(NotFound());
                }
                else
                {
                    throw;
                }
            }

            return(RedirectToPage("./Index"));
        }
        // To protect from overposting attacks, enable the specific properties you want to bind to.
        // For more details, see https://aka.ms/RazorPagesCRUD.
        public async Task <IActionResult> OnPostAsync()
        {
            if (!ModelState.IsValid)
            {
                return(Page());
            }

            _context.Attach(Employee).State = EntityState.Modified;

            try
            {
                string userName = HttpContext.User.Identity.Name;
                var    ssn      = new SqlParameter();
                ssn.ParameterName = @"@SSN";
                ssn.DbType        = DbType.AnsiStringFixedLength;
                ssn.Direction     = ParameterDirection.Input;
                ssn.Value         = Employee.Ssn;
                ssn.Size          = ssn.Value.ToString().Length;

                var salary = new SqlParameter();
                salary.ParameterName = @"@Salary";
                salary.DbType        = DbType.Currency;
                salary.Direction     = ParameterDirection.Input;
                salary.Value         = Employee.Salary;

                System.FormattableString query = $"UPDATE [dbo].[Employees] SET [SSN] = {ssn}, [FirstName] = {Employee.FirstName}, [LastName] = {Employee.LastName}, [Salary] = {salary} WHERE [EmployeeID] = {Employee.EmployeeId}";
                string queryString             = $"UPDATE [dbo].[Employees] SET [SSN] = '{Employee.Ssn}', [FirstName] = '{Employee.FirstName}', [LastName] = '{Employee.LastName}', [Salary] = '{Employee.Salary}' WHERE [EmployeeID] = '{Employee.EmployeeId}'";
                await _context.Database.ExecuteSqlInterpolatedAsync(query);

                await _context.Database.ExecuteSqlInterpolatedAsync($"INSERT INTO [dbo].[AuditEvents] ([UserName], [Query]) VALUES ({userName}, {queryString})");
            }
            catch (DbUpdateConcurrencyException)
            {
                if (!EmployeeExists(Employee.EmployeeId))
                {
                    return(NotFound());
                }
                else
                {
                    throw;
                }
            }

            return(RedirectToPage("./Index"));
        }