Platform for creating data-oriented web apps In my web development company, we have many designers who have the following development knowledge:


Client-side web languages (HTML, CSS, JavaScript)
Basic database design (how to create tables, relationships, etc), and
Basic SQL


So we thought about giving them a simple platform to create data-oriented web apps.


What do you think of the following coding style for ASP.NET MVC?
How can we improve it?
Any ideas for a better SQL injection solution than the params array? Remember that the code should look clean and simple.




/apps/pages/index.html

@(DB.Select(table: "pages", 
            where: "id = ? and date &gt; ?",
            params: new[] { Request.QueryString["ID"], Request.QueryString["Date"] }))

&lt;html&gt;
&lt;body&gt;
    &lt;ul&gt;
    @foreach (var row in Model) {
        &lt;li&gt;&lt;a href="@row.URL"&gt;@row.Name&lt;/a&gt;&lt;/li&gt;
    }
    &lt;/ul&gt;
&lt;/body&gt;
&lt;/html&gt;


/apps/pages/create.html

@(DB.InsertOnPost(table: "pages",
                  fields: "name, description, date",
                  values: "?, ?, Now",
                  params: new[] { Request.Form["Name"], Request.Form["Description"] }))

@RedirectOnPost("/pages")

&lt;form action="/pages/create" method=”post”&gt;
    &lt;div&gt;
        &lt;label for="name"&gt;Name&lt;/label&gt;
        &lt;input type="text" name="name" /&gt;
    &lt;/div&gt;

    &lt;div&gt;
        &lt;label for="description"&gt;Description&lt;/label&gt;
        &lt;textarea name="description"&gt;&lt;/textarea&gt;
    &lt;/div&gt;
&lt;/form&gt;


/apps/pages/edit.html

@(DB.UpdateOnPost(table: "pages",
                  set: "name = ?, description = ?",
                  where: "id = ?",
                  params: new[] { Request.Form["Name"], Request.Form["Description"], 
                                  Request.QueryString["ID"] }))

@RedirectOnPost("/pages")

@(DB.Select(table: "pages", 
            where: "id = ?",
            params: new[] { Request.QueryString["ID"] })

&lt;form action="/pages/edit" method="post"&gt;
    &lt;div&gt;
        &lt;label for="name"&gt;Name&lt;/label&gt;
        &lt;input type="text" name="name" value="@Model.Name" /&gt;
    &lt;/div&gt;

    &lt;div&gt;
        &lt;label for="description"&gt;Description&lt;/label&gt;
        &lt;textarea name="description"&gt;@Model.Description&lt;/textarea&gt;
    &lt;/div&gt;
&lt;/form&gt;
That coding style looks more like the WebMatrix Web Pages pattern rather than ASP.Net MVC. If this coding style is desired then it would be preferable to go ahead and use the data access library that is usually used with Web Pages, the WebMatrix.Data library. That will by default guard against SQL Injection as long as the convention of the parameterized queries is used, e.g. 

    selectCommand = "SELECT URL, Name FROM Pages WHERE ID = @0 AND Date = @1";
    selectedData = db.Query(selectCommand, Request.QueryString["Id"], Request.QueryString["Date"]);


This should be OK for simple sites, but for larger or more complex sites you would be better to separate the data access from the presentation layer, using the full MVC pattern.  The downside of the pattern shown here is that is difficult to test or debug compared to MVC or WebForms and it tends to introduce duplication in the code.