SparqlParameterizedString Class

This is intended for use in applications which may want to dynamically build SPARQL queries/updates where user input may comprise individual values in the triples patterns and the applications want to avoid SPARQL injection attacks which change the meaning of the query/update.

It works broadly in the same way as a SqlCommand would in that you specify a string with paramters specified in the form @name and then use various set methods to set the actual values that should be used. The values are only substituted for parameters when you actually call the ToString() method to get the final string representation of the command. E.g.

SparqlParameterizedString queryString = new SparqlParameterizedString();
queryString.CommandText = @"SELECT * WHERE
{
    ?s a @type .
}";
queryString.SetUri("type", new Uri("http://example.org/myType"));
Console.WriteLine(queryString.ToString());

Would result in the following being printed to the Console:

SELECT * WHERE
{
    ?s a <http://example.org/myType>
}

Calling a Set method to set a parameter that has already been set changes that value and the new value will be used next time you call ToString() - this may be useful if you plan to execute a series of queries/updates using a series of values since you need not instantiate a completely new parameterized string each time.

This class was added to a library based on a suggestion by Alexander Sidorov and ideas from slides from Slideshare by Almedia et al.

PERFORMANCE TIPS: if building the command text incrementally, avoid using CommandText += and use the AppendSubQuery or Append methods instead.

Reference