passing values form views to controller in mvc .net

Question

for view:-

here op is my selected value from html dropdown & e is value of a button click.. i just want to pass both two values to my controller from where i can put those in my sql query. how i can pass those two variable in my @UrlAction so i can get those in mycontroller

  function details()

{                                                                                            
 var op; 
var e = document.getElementById("test").Value;

$("mydropdown option").each(function (i) {

  var op = $(this).attr('selected').val();
})

window.open('@UrlAction("UserLayerView", "home", new {layertype = e, layername= op })')
}

for controller:-

public ActionResult UserLyerView(DataTable as dt, String layertype, String layername)
{
string query = "select column name from" + layertype + "Where name =" +layername; 
}

danger will robinson! never ever concatenate user input into a sql query- I could completely pwn your database server just from the query string - look into SQL parameters; now; what is the question here? does the UrlAction work? (and: shouldn't that be Url.Action(...)?) does it give the right result? what happens when the window.open fires? basically: in what way do your expectation and reality differ? — Marc Gravell
– Marc Gravell, Commented Nov 21, 2017 at 9:08
and what does "is not working" mean here? is it failing with a compilation error? is it giving the wrong result? is it throwing an exception at runtime? Did you try Url.Action(...) instead of UrlAction(...)? — Marc Gravell
– Marc Gravell, Commented Nov 21, 2017 at 9:11
I so want to search for layer name and 1=0; drop table users; -- — Marc Gravell
– Marc Gravell, Commented Nov 21, 2017 at 9:18
Side note: Concatenating query string is not a good thing since it induces SQL injection attempt - use parameterized query instead. Also you can't use client-side variable concatenation inside Url.Action - it should be using query string like this: window.open('@Url.Action("UserLayerView", "Home")' + '?layertype=' + e + '&layername=' + op). — Tetsuya Yamamoto
– Tetsuya Yamamoto, Commented Nov 21, 2017 at 9:26

Marc Gravell · Accepted Answer · 2017-11-21 09:14:43Z

1

You are mixing client-side and server-side code. The e and op variables are client-side javascript; Url.Action is server-side razor code. You cannot use client-side variables in a server-side operation, because they don't exist yet (and when they do: Url.Action will make no sense). So; you'll have to build the url manually and dynamically via concatenation. You could also set inputs on a hidden form (perhaps action="get") and submit that.

answered Nov 21, 2017 at 9:14

Marc Gravell

1.1m273 gold badges2.6k silver badges3k bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

passing values form views to controller in mvc .net

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related