Search code examples
servicestackormlite-servicestack

ServiceStack: Disable escaping wildcards in typed expressions


I'm trying to generate a SQL LIKE query such as:

SELECT COUNT(1) FROM Users WHERE SearchField LIKE '%email:%domain.com%'

In OrmLite, the Contains statement escapes the % character generating this SQL:

SELECT COUNT(1) FROM Users WHERE upper("Users"."SearchField") like '%EMAIL:^%DOMAIN.COM%' escape '^'

Is it possible to disable the escaping (added in 4.0.19) or is there a better approach to generating the SQL statement?

Thanks,


Solution

  • OrmLite's Typed API escapes wildcard strings so they're taken literally as a security precaution to prevent user input from returning sensitive data.

    The easiest way is to use a custom SQL fragment, e.g:

    q.Where("SearchField LIKE {0}", "%email:%domain.com%");
    

    Otherwise it is possible to override EscapeWildcards() in a custom DialectProvider (i.e. that inherits your preferred provider) to return the value without escaping the wildcards but that's an advanced customization I'd only consider if you're comfortable with maintaining a custom DialectProvider.