---
title: clsProviderCollection
summary: API reference for clsProviderCollection.
status: draft
owner: SAIF Doc Gen
last_reviewed: 2026-08-21
library: SAIF.Business.View.Provider
reference_type: embedded
---

# clsProviderCollection

`clsProviderCollection` retrieves a set of `clsProvider` objects either by an array of tax IDs or by an arbitrary caller-supplied WHERE clause (OP-13). It builds its query by string concatenation rather than bind variables, which makes both retrieval paths a potential SQL-injection vector if fed untrusted input ([BR-PRV-003](../../business-rules.md#br-prv-003-provider-set-retrieval-uses-unparameterized-sql)).

## Purpose
- Loads multiple providers in one round trip when a caller has a known list of tax IDs, avoiding per-provider `GetProvider` calls.
- Exposes an escape hatch (`GetProvidersUsingWhere`) that lets a caller inject a raw WHERE clause, which the criteria layer inserts verbatim into the SQL text with no parameterization or sanitization ([BR-PRV-003](../../business-rules.md#br-prv-003-provider-set-retrieval-uses-unparameterized-sql)).
- Never allows creation, update, or deletion of provider records; the collection is a strict read path ([BR-DATA-001](../../business-rules.md#br-data-001-no-write-operations-are-supported)).

## Context
- Namespace: `SAIF.Business.View.Provider`
- Assembly/package: `SAIF.Business.View.Provider` (embedded/project-compiled); also distributed as the NuGet package `SAIF.BOF.Business.View.Provider`.

## Public members
| Member | Signature | Purpose |
| --- | --- | --- |
| `GetProviderCollection` | `Shared Function GetProviderCollection(dpi As IDataPortalInfo, taxIDs As String()) As clsProviderCollection` | Retrieves providers whose primary tax ID is in the supplied array, built as an unparameterized `IN (...)` clause (OP-13, [BR-PRV-003](../../business-rules.md#br-prv-003-provider-set-retrieval-uses-unparameterized-sql)). |
| `GetProvidersUsingWhere` | `Shared Function GetProvidersUsingWhere(dpi As IDataPortalInfo, whereClause As String) As clsProviderCollection` | Retrieves providers matching a caller-supplied WHERE clause appended verbatim to the base SQL (OP-13, [BR-PRV-003](../../business-rules.md#br-prv-003-provider-set-retrieval-uses-unparameterized-sql)). |
| `Item` | `Default ReadOnly Property Item(index As Integer) As clsProvider` (from `clsBusinessCollection(Of clsProvider)`) | Returns the provider at the given position in the loaded collection. |
| `Count` | `ReadOnly Property Count As Integer` (from `clsBusinessCollection(Of clsProvider)`) | Number of providers returned by the retrieval query. |
| `IsValid` | `ReadOnly Property IsValid As Boolean` (overridden from `clsBusinessBase`/collection base) | Reflects aggregate rule-check state of the member providers; not used to gate any write since none exist. |
| `IsDirty` | `ReadOnly Property IsDirty As Boolean` (overridden from `clsBusinessBase`/collection base) | Indicates in-memory changes to member providers; has no effect on persistence since no write SQL is defined ([BR-DATA-001](../../business-rules.md#br-data-001-no-write-operations-are-supported)). |
| `Save` | `Function Save() As clsProviderCollection` (overridden from collection base) | Calls `ApplyEdit()`/`MyBase.Save()` but cannot persist any change because the criteria's insert/update/delete SQL properties throw ([BR-DATA-001](../../business-rules.md#br-data-001-no-write-operations-are-supported)).* |

## Behavioral notes
- OP-13: `Criteria.BuildSQLWhere()` either emits the caller's WHERE clause unchanged or concatenates a `where prv.primary_tax_id in ('…','…')` clause from the tax-ID array; `BeforeRetrieve` binds no parameters for either path, and `AfterRetrieve` loads one `clsProvider` per returned row.
- Because neither retrieval path uses bind variables, a caller passing untrusted input (e.g., from a UI field) into `GetProvidersUsingWhere` or the tax-ID array could allow arbitrary SQL execution ([BR-PRV-003](../../business-rules.md#br-prv-003-provider-set-retrieval-uses-unparameterized-sql)).*

## Constraints and usage notes
- Callers must only pass trusted, application-controlled values to `GetProvidersUsingWhere`; there is no sanitization layer in this library.*
- The collection cannot persist any change made to its member `clsProvider` instances; all SQL beyond retrieval throws `ApplicationException` ([BR-DATA-001](../../business-rules.md#br-data-001-no-write-operations-are-supported)).

> **Note:** Statements marked with `*` were inferred from code structure, naming
> conventions, or contextual evidence where direct confirmation was not available
> in source artifacts. Statements marked with `**` could not be confirmed; treat
> as unknown until verified.

## Sources
- SAIF.Business.View.Provider/clsProviderCollection.vb