Interview | Q3

repository.cs

public class OrdersApiController : UmbracoApiController
{
    private readonly IUmbracoDatabase _database;
    
    public OrdersApiController(IUmbracoDatabase database)
    {
        _database = database;
    }
    
    [HttpPost]
    public IActionResult CreateOrder(string customerName, string productName, int quantity)
    {
        var sql = "INSERT INTO Orders (CustomerName, ProductName, Quantity, OrderDate) " +
                  "VALUES ('" + customerName + "', '" + productName + "', " + quantity + ", GETDATE())";
        
        _database.Execute(sql);
        
        var orderId = _database.ExecuteScalar<int>(
            "SELECT TOP 1 Id FROM Orders WHERE CustomerName = '" + customerName + "' ORDER BY Id DESC"
        );
        
        return Ok(new { OrderId = orderId, Message = "Order created successfully" });
    }
}