this sounds great, but I have a question. How do you handle the fact that you almost never return domain objects to the API? You almosmt always have some sort of viewmodel object that contains just the public data.

Can I have some extension method that does something like .Select(x => MapToViewModel(x)) that I call before returning the AsQueryable() that will be run before returning data to the client?

In other words, if you have

[Queryable]

public IQueryable<Physician> Get()

{

if (_entities == null)

{

_entities = new FindDoctorEntities();

}

return _entities.Physicians;

}

and someone execute /api/physicians?$filter=FirstName+eq+'Jon'

The generated query will be something like WHERE FIRST_NAME = 'Jon' which might not efficient in terms of performance and scare me in terms of SQL injection even though some kind of character escaping might be happening in the background to "prevent it".

Do you know any way to avoiding such not parametrized query generated when using things like oData $filter?

Best,

Michel Fornaris

See stackoverflow.com/ and aspnetwebstack.codeplex.com/