c# - What goes in the params parameter of the .SqlQuery() method in Entity Framework? -

the method takes string query, , array of object [] parameters, presumably avoid sql injection.

however on earth documented should put object array.

there question on asks exact same thing, accepted answer doesn't work: when using dbset<t>.sqlquery(), how use named parameters?

i've tried forms of parameter replacement can think of , of them throw exception. ideas?

would simple as:

sqlquery("select * @table", "users")

edit: here things i've tried (exception sqlexception):

    var result = context.users.sqlquery<t>("select * @p0 @p1 = '@p2'",  new sqlparameter("p0", tablename),  new sqlparameter("p1", propertyname),  new sqlparameter("p2", searchquery)); 

this gives must declare table variable "@p0".

var result = context.users.sqlquery<t>("select * {0} {1} = '{2}'", tablename, propertyname, searchquery); 

this gives must declare table variable "@p0".

there nothing wrong query syntax or how created , passed in sqlparameter objects.

your problem try use a variable table name, cannot (see: must declare table variable @table), need manually "template" table name in query:

something like.

var result = context.users.sqlquery<t>( "select * " + tablename + " @p0 = '@p1'",     new sqlparameter("p0", propertyname),     new sqlparameter("p1", searchquery));