先貼一下，有空再整理
XmlReaderSettings settings = new XmlReaderSettings();
            settings.DtdProcessing = DtdProcessing.Prohibit;
            settings.XmlResolver = null;            
            XmlReader xmlReader = XmlReader.Create(new StringReader(value), settings);
  
            XmlDocument doc = new XmlDocument();
            doc.XmlResolver = null; //弱掃修正
            doc.Load(xmlReader);
            return doc;

Entity Framework 提供了 ExecuteSqlRawAsync 和 FromSqlRaw  之後，可以和 Dapper 非常類似的用法。

我們在用 Dapper 時。最常用的就是 sql command 加上一個物件做為參數，就可以執行 CRUD 的動作。

其實用 Entity Framework 的 ExecuteSqlRawAsync 和 FromSqlRaw 也可以逹到幾乎一樣的效果。

ExecuteSqlRawAsync 和 FromSqlRaw 接受的參數是 object array (其實是 Microsoft.Data.SqlClient.SqlParameter 的 array)

所以我們先做一個 Object to Microsoft.Data.SqlClient.SqlParameter Array 的擴充, 可參考: https://gist.github.com/aliozgur/75182b2e9b0a58b83443

不過很奇怪的是，原作者提供的擴充轉出來的會是 System.Data.SqlClient.SqlParameter  Array 無法直接使用於 ExecuteSqlRawAsync 和 FromSqlRaw，所以要稍微改一下，把 using System.Data.SqlClient; 改為 using Microsoft.Data.SqlClient; 即可:



另外，我們再自行 對 DbContext 做一個擴充如下:

        /// <summary>
        /// 會把物件 Parameter 的各 Property 帶入 SQL 中.
        /// </summary>
        /// <param name="dbct"></param>
        /// <param name="sql"></param>
        /// <param name="parameters"></param>
        /// <returns></returns>
        public static async Task<int> ExecuteParameterSqlAsync(this DbContext dbct, string sql, object parameters)
        {
            return await dbct.Database.ExecuteSqlRawAsync(sql, parameters.ToSqlParamsArray());
        }

最後的結果可以做到以下的效果: (res3 和 res4 是配合 FormattableString 的範例 )

 
範例程式碼:

        public async Task<object> EfTest()
        {
            var dbct = Ds.NewContext.GvContext;
            var insertSql = @"Insert into ProfileEvent(JobId,[Name],GvShoplineId,LiShoplineId,Phone,Email,LineId,GaClientId)
            Values(@JobId, @Name, null , null , null , @Email, @GaClientId , @GaClientId )";

            //執行 SQL 的原生寫法
            await dbct.Database.ExecuteSqlRawAsync(insertSql, new object[]
            {
                new SqlParameter("@JobId", 10),
                new SqlParameter("@Email", "XX'TT"),
                new SqlParameter("@Name", "AA'BB"),
                new SqlParameter("@GaClientId", "GaClientId"),
            });

            //執行 SQL 的擴充寫法
            await dbct.ExecuteParameterSqlAsync(insertSql, new
            {
                JobId = 10,
                Email = "XX'TT",
                Name = "AA'BB",
                GaClientId = "GaClientId"
            });

            //關於查詢
            string name = "%'B%";
            //原生寫法
            var res1 = await dbct.ProfileEvents.FromSqlRaw("Select top 100 * from ProfileEvent where Name like @name",
                new object[]
                    {
                        new SqlParameter("@name", "%'B%")
                    })
                .ToListAsync();

            //擴充, object to SqlParameter array
            var res2 = await dbct.ProfileEvents.FromSqlRaw("Select top 100 * from ProfileEvent where Name like @name",
                new { name }.ToSqlParamsArray())
                .ToListAsync();

            var res3 = await dbct.ProfileEvents.FromSql($"Select top 100 * from ProfileEvent where Name like {name}")
                .ToListAsync();

            var res4 = await dbct.ProfileEvents.FromSqlInterpolated($"Select top 100 * from ProfileEvent where Name like {name}")
                .ToListAsync();

            return new { res1, res2, res3, res4 };
        }

 

這個指令還是會把所有的資料 Select 出來，再更新

原指令:

UPDATE Job Set En_Status = 200 Where En_Status = 100 and LastTouchAt < '2023-05-06 12:34:56'
其中  '2023-05-06 12:34:56' 是 DateTime.Now.AddMinutes(-2) 的結果(Web Server 端的時間扣 2 分鐘)

但，若是改使用 UpdateFromQueryAsync 如下:
var c = await Ds.NewContext.GvContext.Jobs.Where(j => j.En_Status == Cst.Job.Status.Running && j.LastTouchAt < DateTime.Now.AddMinutes(-2))
                .UpdateFromQueryAsync(j => new Ds.Gv.Job { En_Status = Cst.Job.Status.ReStarting });

產生的 SQL 如下:
UPDATE A 
SET A.[En_Status] = @zzz_BatchUpdate_0
FROM [Job] AS A
INNER JOIN ( SELECT [j].[Id], [j].[CancelledAt], [j].[CancelledBy], [j].[En_Status], [j].[EndAt], [j].[Exception], [j].[Filename], [j].[InformationJson], [j].[InitAt], [j].[Is_CheckOnly], [j].[LastTouchAt], [j].[LastTouchMessage], [j].[LoopStartAt], [j].[Name], [j].[ScheduleId], [j].[TotalTouch], [j].[TouchCount]
FROM [Job] AS [j]
WHERE [j].[En_Status] = 100 AND [j].[LastTouchAt] < DATEADD(minute, CAST(-2.0E0 AS int), GETDATE())
           ) AS B ON A.[Id] = B.[Id]

有兩個要注意的地方:
1. 它會先 Select 全欄位，再做更新

2. 它的時間是 DB Server 的現在時間。不是 Web Server 端的時間。


順便記錄一下。若是要執行 Update xx Ser cc = cc + 1 Where ...

EF 可寫為:
var c = await Ds.NewContext.GvContext.Jobs.Where(j => j.En_Status == Cst.Job.Status.Running && j.LastTouchAt < DateTime.Now.AddMinutes(-2))
                .UpdateFromQueryAsync(j => new Ds.Gv.Job { TotalTouch = j.TotalTouch + 1 });

轉換的 SQL 為:
UPDATE A 
SET A.[TotalTouch] = B.[TotalTouch] + 1
FROM [Job] AS A
INNER JOIN ( SELECT [j].[Id], [j].[CancelledAt], [j].[CancelledBy], [j].[En_Status], [j].[EndAt], [j].[Exception], [j].[Filename], [j].[InformationJson], [j].[InitAt], [j].[Is_CheckOnly], [j].[LastTouchAt], [j].[LastTouchMessage], [j].[LoopStartAt], [j].[Name], [j].[ScheduleId], [j].[TotalTouch], [j].[TouchCount]
FROM [Job] AS [j]
WHERE [j].[En_Status] = 100 AND [j].[LastTouchAt] < DATEADD(minute, CAST(-2.0E0 AS int), GETDATE())
           ) AS B ON A.[Id] = B.[Id]

dotnet publish -f:net7.0-android -c:Release

在新增 .Net 7 專案時。不用特別指定 app.UseRouting() 就可以使用 attribute routing.

但會遇到一個問題:

原來應該出靜態檔案的 Request 會被符合 Routing Rule 的 Action 攔截。

解決的方法是 :

在 UseStaticFiles 之後手動再加上 app.UseRouting(), 範例如下:

app.UseStaticFiles(new StaticFileOptions
{
    OnPrepareResponse = ctx =>
    {
        const int durationInSeconds = 60 * 60 * 24 * 365; //一年
        ctx.Context.Response.Headers[HeaderNames.CacheControl] =
            "public,max-age=" + durationInSeconds;
    }
});

app.UseRouting();

我們會使用 Validation Attribute 來客製化 Validation 的輸出結果，但在 .Net 7 的專案突然失效了。原因是 [ApiController] 會自動回傳 400 錯誤，攔截了 Validation Attribution 的執行。

解決方法, 在 program.cs 中加上以下的程式碼:

builder.Services.Configure<ApiBehaviorOptions>(options
=> options.SuppressModelStateInvalidFilter = true);
 

試了這兩個 Sample:

https://learn.microsoft.com/en-us/training/modules/store-local-data/4-exercise-store-data-locally-with-sqlite

和 

https://blazorhelpwebsite.com/ViewBlogPost/61

結果專案在 Windows 環境下都可以正常執行，但切換到 Android Emulator 就無法存檔。

在查了很多資料後，發現需要裝額外的 Package，需安裝的 Package 如下:

    <ItemGroup>
     <PackageReference Include="sqlite-net-pcl" Version="1.8.116" />
     <PackageReference Include="SQLiteNetExtensions.Async" Version="2.1.0" />
     <PackageReference Include="SQLitePCLRaw.bundle_green" Version="2.1.4" />
     <PackageReference Include="SQLitePCLRaw.core" Version="2.1.4" />
     <PackageReference Include="SQLitePCLRaw.lib.e_sqlite3" Version="2.1.4" />
     <PackageReference Include="SQLitePCLRaw.provider.dynamic_cdecl" Version="2.1.4" />
     <PackageReference Include="System.Data.DataSetExtensions" Version="4.5.0" />
    </ItemGroup>

其它的發現為:
1. 雙點專案，就可以開啟 csproj 檔案。下方的 ItemGroup 就是已安裝的 package

2. 可以把 chrome 連接到 Android Emulator 的方法，在網址列輸入以下指令:
chrome://inspect/#devices

產生 FileStreamResult 物件的 function 如下: (目前置於 SU 之中，以便轉移)

        static List<Brush> CaptchaBrushes = null;
        public static FileStreamResult CreateCaptcha(string captcha)
        {
            if (CaptchaBrushes == null)
            {
                CaptchaBrushes = new List<Brush>();
                CaptchaBrushes.Add(Brushes.White);
                CaptchaBrushes.Add(Brushes.Gold);
                CaptchaBrushes.Add(Brushes.LightSkyBlue);
                CaptchaBrushes.Add(Brushes.LimeGreen);
                CaptchaBrushes.Add(Brushes.AliceBlue);
                CaptchaBrushes.Add(Brushes.AntiqueWhite);
                CaptchaBrushes.Add(Brushes.BurlyWood);
                CaptchaBrushes.Add(Brushes.Silver);
            }

            int width = 90;
            int height = 45;

            //https://stackoverflow.com/questions/61365732/cannot-access-a-closed-stream-when-returning-filestreamresult-from-c-sharp-netc
            //Using statements close and unload the variable from memory set in the using statement which is why you are getting an error trying to access a closed memory stream.You don't need to use a using statement if you are just going to return the result at the end.

            //這個 memory stream 不用關閉或 dispose
            var ms = new MemoryStream();

            // 釋放所有在 GDI+ 所佔用的記憶體空間 ( 非常重要!! )
            using (Bitmap _bmp = new Bitmap(width, height))
            using (Graphics _graphics = Graphics.FromImage(_bmp))
            using (Font _font = new Font("Courier New", 24, FontStyle.Bold)) // _font 設定要出現在圖片上的文字字型、大小與樣式
            {
                // (封裝 GDI+ 繪圖介面) 所有繪圖作業都需透過 Graphics 物件進行操作
                _graphics.Clear(Color.Black);

                // 如果想啟用「反鋸齒」功能，可以將以下這行取消註解
                //_graphics.TextRenderingHint = TextRenderingHint.AntiAlias;

                // 將亂碼字串「繪製」到之前產生的 Graphics 「繪圖板」上
                var x = 10;
                for(var i = 0; i < captcha.Length; i++)
                {
                    _graphics.DrawString(captcha.Substring(i, 1), _font, CaptchaBrushes[Su.MathUtil.GetRandomInt(CaptchaBrushes.Count)], x, Su.MathUtil.GetRandomInt(15));
                    x += 10 + Su.MathUtil.GetRandomInt(10);
                }

                // 畫線
                
                _graphics.DrawLine(new Pen(CaptchaBrushes[Su.MathUtil.GetRandomInt(CaptchaBrushes.Count)], 1),
                    Su.MathUtil.GetRandomInt(0, Convert.ToInt32((width * 0.9 / 2))), 0, Su.MathUtil.GetRandomInt(Convert.ToInt32(width / 2), Convert.ToInt32(width * 1.9 / 2)), height);
                
                _graphics.DrawLine(new Pen(CaptchaBrushes[Su.MathUtil.GetRandomInt(CaptchaBrushes.Count)], 1),
                    Su.MathUtil.GetRandomInt(Convert.ToInt32(width / 2), Convert.ToInt32(width * 1.9 / 2)), 0, Su.MathUtil.GetRandomInt(0, Convert.ToInt32((width * 0.9 / 2))), height);
                
                _graphics.DrawLine(new Pen(CaptchaBrushes[Su.MathUtil.GetRandomInt(CaptchaBrushes.Count)], 1),
                    0,
                    Su.MathUtil.GetRandomInt(height / 2),
                    width,
                    height / 2 + Su.MathUtil.GetRandomInt(height / 2)
                    );

                _graphics.DrawLine(new Pen(CaptchaBrushes[Su.MathUtil.GetRandomInt(CaptchaBrushes.Count)], 1),
                 0,
                 height / 2 + Su.MathUtil.GetRandomInt(height / 2),
                 width,
                    Su.MathUtil.GetRandomInt(height / 2)
                 );

                _bmp.Save(ms, System.Drawing.Imaging.ImageFormat.Jpeg);
            }

            ms.Seek(0, SeekOrigin.Begin);

            // Controller 的型別為 FileResult
            return new FileStreamResult(ms, "image/jpeg")
            { FileDownloadName = $"{DateTime.Now.Ymdhmsf()}.jpg" };
        }

輸出用的 Controller 和 Action 如下:

namespace Web.Controllers
{
    public class CaptchaController : Controller
    {
        [Route("captcha")]
        public async Task<FileStreamResult> Index()
        {
            //產生 Captcha 並存入 Session 之中。目前是四位數字
            string captcha = (await Ah.ReGetAsync<object>("api/kol/create-captcha-code")).ToString();

            //產生圖檔並回傳 FileStreamResult
            return Su.Wu.CreateCaptcha(captcha);
        }
    }
}

接到弱掃報告指出以下的程式碼會造成危害:

string Url = WebConfigurationManager.AppSettings["SkyShopCheckoutURL"] + $"/api/token/ {Su.Fsc.SessionId}"; ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls12;
HttpClient client = Su.Wu.GetClient();
var response = await client.GetAsync(Url);
var message = await response.Content.ReadAsStringAsync(); result = JsonConvert.DeserializeObject(message);

沒想到吧...

使用者輸入的資料包括 cookie 的資料, header 的資料，form 和 query string 的資料。

可以使用以下的 function 避免寫入錯誤的檔案:

var newFilename = filename.Replace("..", "").ValidFilenameCharacters();