Controller method to update properties of a request I have a view that displays details of a work order request submitted by a user. As far as security and database querying is concerned, which one of the following options would be better if I'm going to update a table named "Requests" with some changes to the properties? Is the extra query to the dbcontext in option 2 worth the security benefit?

Note: some properties omitted to reduce code.

Option 1:

[HttpPost]
[ValidateAntiForgeryToken]
public ActionResult Details(DetailsViewModel request)
{

    var model = new Request
    {
        Id = request.Id,
        RequestDate = request.RequestDate,
        Status = request.Status,
        FirstName = request.FirstName,
        LastName = request.LastName,
        LastModificationDate = DateTime.Now,
        AffiliationId = request.AffiliationId,
        IssueId = request.IssueId,
        RequestTypeId = request.RequestTypeId,

    };

    _context.Requests.Attach(model);
    var entry = _context.Entry(model);
    entry.Property(e =&gt; e.Status).IsModified = true;
    entry.Property(e =&gt; e.AffiliationId).IsModified = true;
    entry.Property(e =&gt; e.IssueId).IsModified = true;
    entry.Property(e =&gt; e.RequestTypeId).IsModified = true;
    entry.Property(e =&gt; e.LastModificationDate).IsModified = true;

    _context.SaveChanges();

    return RedirectToAction("Requests");


Option 2:

[HttpPost]
[ValidateAntiForgeryToken]
public ActionResult Details(DetailsViewModel request)
{
    var model = _context.Requests.Find(request.Id);

    model.Status = request.Status;
    model.AffiliationId = request.AffiliationId;
    model.IssueId = request.IssueId;
    model.RequestTypeId = request.RequestTypeId;
    model.LastModificationDate = DateTime.Now;

    _context.Requests.Attach(model);
    var entry = _context.Entry(model);
    entry.Property(e =&gt; e.Status).IsModified = true;
    entry.Property(e =&gt; e.AffiliationId).IsModified = true;
    entry.Property(e =&gt; e.IssueId).IsModified = true;
    entry.Property(e =&gt; e.RequestTypeId).IsModified = true;
    entry.Property(e =&gt; e.LastModificationDate).IsModified = true;

    _context.SaveChanges();

    return RedirectToAction("Requests");
I find the second aproach if better for these reasons:


You dont't have to specify all properties but only those that change
You immediately know if the specified Id is correct because



  If an entity with the given primary key values exists in the context, then it is returned immediately [..]. Otherwise, a request is made to the store for an entity with the given primary key values and this entity, if found, is [..] returned. If no entity is found in the context or the store, then null is returned.



You don't have to manually set the modified properties as modified (unless you've disabled tracking) becasue



  this entity, if found, is attached to the context


so EF will figure out the properties that changed. All you need is:

var model = _context.Requests.Find(request.Id);

// check if model == null and handle it apropriately

// update the properties
model.Status = request.Status;
model.AffiliationId = request.AffiliationId;
model.IssueId = request.IssueId;
model.RequestTypeId = request.RequestTypeId;
model.LastModificationDate = DateTime.Now;

// no need to attach it or set properties as modified
// EF already knows this model and can track changes

// save changes
_context.SaveChanges();


I'd say this is more secure as you work with an entity that really exists, in case someone tried to post an invalid Id. Less work becasue EF handles tracking and ataching the entity thus less error prone.



source: DbSet.Find Method