Building a wrapper to perform SQL queries from Powershell - sql-server

Question

I'm trying to build an all-purpose wrapper to easily query a SQL Server database from within Powershell and work with the results:
$result = SQL("SELECT * CustomerID FROM [dbo].[TblCustomers]")
$result.Tables[0] | Foreach {
Write-Host $_.CustomerID
}
Wrapper
## Wrapper for SQL Select statements
#
Function SQL {
param(
[string]$query
)
$Server = "SQLEXPRESS"
$DBase = "DataStore"
$User = "DataUser"
$Pass = "DataPass"
$conn = New-Object System.Data.SqlClient.SqlConnection("Server=$Server;Database=$DBase;User=$User;Password=$Pass;Connect Timeout=15")
try {
$conn.Open()
$cmd = New-Object System.Data.SqlClient.SqlCommand($query,$conn)
$adapter = New-Object System.Data.SqlClient.SqlDataAdapter($cmd)
$dataset = New-Object System.Data.DataSet
$adapter.Fill($dataset) | Out-Null
$conn.Close()
}
catch {
$ex = $_.Exception
Write-Error "$ex.Message"
continue
}
return $dataset
}
This only works for SELECT statements however:
If I perform and UPDATE or INSERT, I would like to return the # of rows affected, or an error if applicable
Any other query (ALTER, DROP, DELETE) should be ignored, error message returned
What is the best way to:
Identify the sort of query command (SELECT, DROP)?
Handle all requests in one function? (A switch statement or redirect to specific function?)
Any help is greatly appreciated.
P.S. As I would be the only one using the function in backend scripts, I am not too worried about SQL injection.
[edit]
I now have:
Function Query {
param (
[string]$query
[string]$server
[string]$dbase
[string]$user
[string]$pass
)
if ($user) {
$connstr = "Server={0};Database={1};User ID={2};Password={3};Trusted_Connection=False;Connect Timeout=15" -f $server, $dbase, $user, $pass
}
else {
$connstr = "Server={0};Database={1};Integrated Security=True;Connect Timeout=15" -f $server, $dbase
}
$conn.ConnectionString = $connstr
switch ($query.Split()[0]) {
"SELECT" {
$cmd = New-Object System.Data.SqlClient.SqlCommand($query,$conn)
$adapter = New-Object System.Data.SqlClient.SqlDataAdapter($cmd)
$dataset = New-Object System.Data.DataSet
$adapter.Fill($dataset) | Out-Null
return $dataset
}
"UPDATE" {
$cmd = New-Object System.Data.SqlClient.SqlCommand($query,$conn)
return $cmd.ExecuteNonQuery()
}
"INSERT" {
$cmd = New-Object System.Data.SqlClient.SqlCommand($query,$conn)
return $cmd.ExecuteNonQuery()
}
}
}

Answer 1

Here is a sample you can build from that uses parameter sets to identify query types. The executenonquery method returns the number of rows affected by the query. I use a validatescript attribute to prevent any query containing the words drop, delete, or alter. You can add others as needed. I don't have a SQL box handy to test with but this should work. You could also adjust this to use parameters for the server, db, user, pass, instead of hardcoding them to make it reusable.
function Invoke-SQLQuery
{
[CmdletBinding(DefaultParameterSetName='SELECT',
SupportsShouldProcess=$true,
ConfirmImpact='Medium')]
Param
(
# Param1 help description
[Parameter(Mandatory=$true,
Position=0,
ParameterSetName='SELECT')]
[Parameter(Mandatory=$true,
Position=0,
ParameterSetName='UPDATE')]
[Parameter(Mandatory=$true,
Position=0,
ParameterSetName='INSERT')]
[ValidateNotNull()]
[ValidateNotNullOrEmpty()]
[ValidateScript({$_ -notmatch "ALTER|DROP|DELETE" })]
$Query,
# Param2 help description
[Parameter(ParameterSetName='SELECT')]
[switch]
$Select,
# Param3 help description
[Parameter(ParameterSetName='UPDATE')]
[switch]
$Update,
[Parameter(ParameterSetName='INSERT')]
[switch]
$Insert
)
Begin
{
$Server = "SQLEXPRESS"
$DBase = "DataStore"
$User = "DataUser"
$Pass = "DataPass"
$conn = New-Object System.Data.SqlClient.SqlConnection("Server=$Server;Database=$DBase;User=$User;Password=$Pass;Connect Timeout=15")
}
Process
{
if ($pscmdlet.ShouldProcess("$Server", "Execute Query"))
{
try
{
$conn.Open()
switch($pscmdlet.ParameterSetName){
"SELECT" {
$cmd = New-Object System.Data.SqlClient.SqlCommand($query,$conn)
$adapter = New-Object System.Data.SqlClient.SqlDataAdapter($cmd)
$dataset = New-Object System.Data.DataSet
$adapter.Fill($dataset) | Out-Null
return $dataset
}
"UPDATE" {
$cmd = New-Object System.Data.SqlClient.SqlCommand($query,$conn)
return $cmd.ExecuteNonQuery()
}
"INSERT" {
$cmd = New-Object System.Data.SqlClient.SqlCommand($query,$conn)
return $cmd.ExecuteNonQuery()
}
}
}
catch [System.Data.SqlClient.SqlException]
{
#Implement Error Handling
$ex = $_.Exception
Write-Error "$ex.Message"
continue
}
finally
{
$conn.Close()
$conn.Dispose()
}
}
}
}