[AttributeUsage(AttributeTargets.Method | AttributeTargets.Class, AllowMultiple = false, Inherited = true)]
    public class SanitizeInputAttribute : ActionFilterAttribute
    {
        private readonly ISanitizer _sanitizer;

        public SanitizeInputAttribute()
        {
            _sanitizer = new Sanitizer();
        }

        public override void OnActionExecuting(ActionExecutingContext filterContext)
        {
            if (filterContext.ActionArguments != null)
            {
                foreach (var parameter in filterContext.ActionArguments.ToList())
                {
                    if (parameter.Value != null)
                    {
                        var type = parameter.Value.GetType();
                        if (type == typeof(string))
                        {
                           var sanitized = _sanitizer.Sanitize(parameter.Value.ToString());
                           filterContext.ActionArguments[parameter.Key] = sanitized;
                        }
                        else
                        {
                            var properties = parameter.Value.GetType()
                                .GetProperties(BindingFlags.Instance | BindingFlags.Public)
                                .Where(x => x.CanRead && x.CanWrite && x.PropertyType == typeof(string) &&
                                            x.GetGetMethod(true).IsPublic && x.GetSetMethod(true).IsPublic);



                            foreach (var propertyInfo in properties)
                            {
                                if (propertyInfo.GetValue(parameter.Value) != null)
                                    propertyInfo.SetValue(parameter.Value,
                                        _sanitizer.Sanitize(propertyInfo.GetValue(parameter.Value).ToString()));
                            }
                        }
                    }
                }
            }

        }
    }

 public class Kala
    {
        [Key]
        public int Kala_id { get; set; }
        
        [DisplayName("نام کالا")]
        public string Name { get; set; }

        [DisplayName("قیمت خرید")]
        public double Fee_Kharid { get; set; }
     
        public virtual Brand Brand { get; set; }
        
        public ICollection<Anbar_Kala> Anbar_Kalas { get; set; }
    }

 public class Anbar_Kala
    {
        [ForeignKey("Anbar_Id")]
        public virtual Anbar Anbar { get; set; }
        public int Anbar_Id { get; set; }

        [ForeignKey("Kala_Id")]
        public virtual Kala Kala{ get; set; }
        public int Kala_Id { get; set; }

        [DisplayName("تعداد")]
        public int Tedad { get; set; } //تعداد کالاها در هر انبار
    }

public class KalaViewModel 
    {
        public int Kala_Id { get; set; }
        public string  Name { get; set; }
        public double Fee_Kharid { get; set; }
        public string Brand_Name { get; set; }
        public int Tedad { get; set; }
    }

//controller
        var kala = _Kala_Service.GetAllKalas();
        var tedad= _Anbar_Kala_Service.GetAllAnbar_Kalas();

        var kalaviewmodel = EntityMapper.Map<List<KalaViewModel>>(kala, tedad);


protected override void Configure()
        {
        Mapper.CreateMap<Kala, KalaViewModel>()
       .ForMember(des => des.Brand_Name, op => op.MapFrom(src => src.Brand.Brand_Name));
              
       Mapper.CreateMap<Anbar_Kala, KalaViewModel>(); // این نگاشت باید به چه صورتی باشد؟
      .ForMember(des =>des.Kala_Id, op=>op.Ignore();     
        }

نکات زیر، جالب‌ترین نکات در خصوص شیوه حمله بوده که قابل توجه است:

1. یک کاربر از یک وب سایت حاوی کدهای مخرب و آلوده که یک فایل را میزبانی می‌کند، مانند evil.html بازدید می‌کند.
   
2. با توجه به یک بخش از آسیب پذیری، فایل evil.html دانلود می‌شود و کارت SD آن را بدون هشدار به کاربر، ذخیره می‌کند!
3. با توجه به بخش دیگری از آسیب پذیری، به محض اینکه فایل ذخیره شد، می‌توان کدهای جاوا اسکریپت مخرب را روی آن اجرا کرد!
4. بدلیل بخش پایانی حمله روی این آسیب پذیری، کدهای جاوااسکریپت تحت شرایطی خاص روی سیستم محلی (local) اجرا می‌شوند! ابزار آلوده و برنامه نویسی شده، براحتی روی کارت SD ذخیره و مستقر شده و به وب سایت مهاجم برای ارسال اطلاعات قربانی دسترسی کامل دارد.

public class Result
{
    public bool Success { get; private set; }
    public string Error { get; private set; }
    public bool Failure { /* … */ }
    protected Result(bool success, string error) { /* … */ }
    public static Result Fail(string message) { /* … */ }
    public static Result<T> Ok<T>(T value) {  /* … */ }
}

public class Result<T> : Result
{
    public T Value { get; set; }
    protected internal Result(T value, bool success, string error)
        : base(success, error)
    {
        /* … */
    }
}

public interface IUnitOfWork : IDisposable
    {
        DbSet<TEntity> Set<TEntity>() where TEntity : class;

        int SaveChanges(bool acceptAllChangesOnSuccess);
        int SaveChanges();
        Task<int> SaveChangesAsync(bool acceptAllChangesOnSuccess, CancellationToken cancellationToken = new CancellationToken());
        Task<int> SaveChangesAsync(CancellationToken cancellationToken = new CancellationToken());
        void CheckArgumentIsNull(string v);
    }  
 

void CheckArgumentIsNull(string arg)
        {
            if (arg == null)
                throw new ArgumentNullException(nameof(arg));
        }

An object with the same key already exists in the ObjectStateManager. The ObjectStateManager cannot track multiple objects with the same key

T attachedEntity = set.Find(entity.Id);
var attachedEntry = dbContext.Entry(attachedEntity);
attachedEntry.CurrentValues.SetValues(entity);

public DbContext()
        {
            this.Configuration.ProxyCreationEnabled = false;
            this.Configuration.LazyLoadingEnabled = false;
            this.Configuration.AutoDetectChangesEnabled = false;
         }

 dbContext.Entry(entity).State = EntityState.Detached;

// group id=19  Name="General"  
var customer = new Customer();
customer.Group = group;
customer.Name = "mohammadi";
dbContext.Entry(customer).State = EntityState.Added;
var customerstate = dbContext.Entry(customer).State;// customerstate=EntityState.Added
var groupstate = dbContext.Entry(group);// groupstate=EntityState.Added

// group id=19  Name="General"  
var customer = new Customer();
customer.Group = group;
 customer.Name = "mohammadi";
dbContext.Entry(group).State = EntityState.Unchanged;
dbContext.Entry(customer).State = EntityState.Added;
var customerstate = dbContext.Entry(customer).State;// customerstate=EntityState.Added
 var groupstate = dbContext.Entry(group);// groupstate=EntityState.Unchanged

  // group id=19  Name="General"  
var customer = new Customer();
 customer.Group = group;
customer.Name = "mohammadi";
dbContext.Entry(customer).State = EntityState.Unchanged;
dbContext.Entry(customer).State = EntityState.Added;
var customerstate = dbContext.Entry(customer).State;// customerstate=EntityState.Added
var groupstate = dbContext.Entry(group);//// groupstate=EntityState.Unchanged

var customer  = dbContext.Customers.FirstOrDefault();
 var customerAsNoTracking  = dbContext.Customers.AsNoTracking().FirstOrDefault();
var customerstate = dbContext.Entry(customer).State;// customerstate=EntityState.Unchanged
var customerstateAsNoTracking  = dbContext.Entry(customerAsNoTracking).State;// customerstate=EntityState.Detached

var Entries = dbContext.ChangeTracker.Entries();    
var AddedEntries = dbContext.ChangeTracker.Entries().Where(entityEntry => entityEntry.State==EntityState.Added);
var ModifiedEntries = dbContext.ChangeTracker.Entries().Where(entityEntry => entityEntry.State==EntityState.Modified);
var UnchangedEntries = dbContext.ChangeTracker.Entries().Where(entityEntry => entityEntry.State==EntityState.Unchanged);
var DeletedEntries = dbContext.ChangeTracker.Entries().Where(entityEntry => entityEntry.State==EntityState.Deleted);
var DetachedEntries = dbContext.ChangeTracker.Entries().Where(entityEntry => entityEntry.State==EntityState.Detached);//* not working !

 public virtual void AddOrUpdate(T entity)
        {
            if (entity.Id == 0)
                Add(entity);
            else
                Update(entity);

        }

 public class DataGridViewChildRelationTextBoxCell : DataGridViewTextBoxCell
    {
        protected override object GetValue(int rowIndex)
        {
            try
            {
                var bs = (BindingSource)DataGridView.DataSource;
                var cl = (DataGridViewChildRelationTextBoxColumn)DataGridView.Columns[ColumnIndex];
                return getChildValue(bs.List[rowIndex], cl.DataPropertyName).ToString();
            }
            catch (Exception)
            {
                return "";
            }
        }

        private object getChildValue(object dataSource, string childMember)
        {
            int nextPoint = childMember.IndexOf('.');
            if (nextPoint == -1) return dataSource.GetType().GetProperty(childMember).GetValue(dataSource, null);
            string proName = childMember.Substring(0, nextPoint);
            object newDs = dataSource.GetType().GetProperty(proName).GetValue(dataSource, null);
            return getChildValue(newDs, childMember.Substring(nextPoint + 1));
        }
    }

    public class DataGridViewChildRelationTextBoxColumn : DataGridViewTextBoxColumn
    {
        public string DataMember { get; set; }

        public DataGridViewChildRelationTextBoxColumn()
        {
            CellTemplate = new DataGridViewChildRelationTextBoxCell();
        }
    }

GroupNameColumn= new DataGridViewChildRelationTextBoxColumn(); //from your class
GroupNameColumn.HeaderText = "گروه مشتری";
GroupNameColumn.DataPropertyName = "Group.Name"; //EF  Property: Customer.Group.Name
GroupNameColumn.Visible = true;
GroupNameColumn.Width = 300;
DataGridView.Columns.Add(GroupNameColumn);

namespace IOCBeginnerGuide
{
  class Kid
  {
      private int _age;
      private string _name;

      public Kid(int age, string name)
      {
          _age = age;
          _name = name;
      }

      public override string ToString()
      {
          return "KID's Age: " + _age + ", Kid's Name: " + _name;
      }
  }
}

using System;

namespace IOCBeginnerGuide
{
  class Parent
  {
      private int _age;
      private string _name;
      private Kid _obj;

      public Parent(int personAge, string personName, int kidsAge, string kidsName)
      {
          _obj = new Kid(kidsAge, kidsName);
          _age = personAge;
          _name = personName;
      }

      public override string ToString()
      {
          Console.WriteLine(_obj);
          return "ParentAge: " + _age + ", ParentName: " + _name;
      }
  }
}

using System;

namespace IOCBeginnerGuide
{
  class Program
  {
      static void Main(string[] args)
      {
          Parent p = new Parent(35, "Dev", 6, "Len");
          Console.WriteLine(p);

          Console.ReadKey();
          Console.WriteLine("Press a key...");
      }
  }
}

KID's Age: 6, Kid's Name: Len
ParentAge: 35, ParentName: Dev

//IBuisnessLogic.cs
namespace IOCBeginnerGuide
{
  public interface IBuisnessLogic
  {
  }
}

//Kid.cs
namespace IOCBeginnerGuide
{
  class Kid : IBuisnessLogic
  {
      private int _age;
      private string _name;

      public Kid(int age, string name)
      {
          _age = age;
          _name = name;
      }

      public override string ToString()
      {
          return "KID's Age: " + _age + ", Kid's Name: " + _name;
      }
  }
}

//Parent.cs
using System;

namespace IOCBeginnerGuide
{
  class Parent
  {
      private int _age;
      private string _name;
      private IBuisnessLogic _refKids;

      public Parent(int personAge, string personName, IBuisnessLogic obj)
      {          
          _age = personAge;
          _name = personName;
          _refKids = obj;
      }

      public override string ToString()
      {
          Console.WriteLine(_refKids);
          return "ParentAge: " + _age + ", ParentName: " + _name;
      }
  }
}

//CIOC.cs
using System;

namespace IOCBeginnerGuide
{
  class CIOC
  {
      Parent _p;

      public void FactoryMethod()
      {
          IBuisnessLogic objKid = new Kid(12, "Ren");
          _p = new Parent(42, "David", objKid);
      }

      public override string ToString()
      {
          Console.WriteLine(_p);          
          return "Displaying using Constructor Injection";
      }
  }
}

//Program.cs
using System;

namespace IOCBeginnerGuide
{
  class Program
  {
      static void Main(string[] args)
      {
          CIOC obj = new CIOC();
          obj.FactoryMethod();
          Console.WriteLine(obj);

          Console.ReadKey();
          Console.WriteLine("Press a key...");
      }
  }
}

//Parent.cs
using System;

namespace IOCBeginnerGuide
{
  class Parent
  {
      private int _age;
      private string _name;

      public Parent(int personAge, string personName)
      {          
          _age = personAge;
          _name = personName;
      }

      public IBuisnessLogic RefKID {set; get;}

      public override string ToString()
      {
          Console.WriteLine(RefKID);
          return "ParentAge: " + _age + ", ParentName: " + _name;
      }
  }
}

//CIOC.cs
using System;

namespace IOCBeginnerGuide
{
  class CIOC
  {
      Parent _p;

      public void FactoryMethod()
      {
          IBuisnessLogic objKid = new Kid(12, "Ren");
          _p = new Parent(42, "David");
          _p.RefKID = objKid;
      }

      public override string ToString()
      {
          Console.WriteLine(_p);          
          return "Displaying using Setter Injection";
      }
  }
}