在C#中使用参数化存储过程

时间:2012-07-08 18:26:30

标签: c# stored-procedures ado.net user-defined-functions sql-parametrized-query

我正在尝试在我的C#应用​​程序中调用存储过程,但它并没有真正调用我试过这么多尝试称之为ExecuteReaderNonReaderScalar等但仍然是没有执行我在下面显示我的整个代码,包括我曾经使用的sql命令

请查看我的代码中确实存在的问题

先谢谢

Stock

Create Table Stock
(
--S_ID int Primary Key identity (1,1),
Date_of_Added Datetime Default (getdate()),
EnvType nvarchar(10),
TypeSize nvarchar(10),
Size nvarchar(10),
[Description] sql_variant,
Qty int,
Quality int,
)

NewProduct

Create Table NewProduct
(

MS nvarchar(30),
Date_of_Added Datetime Default (getdate()),
Invoice_No nvarchar(20),
Challan_No nvarchar(20),
EnvType nvarchar(10),
TypeSize nvarchar(10),
Size nvarchar(10),
Description sql_variant,
Qty int,
Quality int,
PayState nvarchar(10),
Balanace_Amount money,
PaymentMode nvarchar(6),
Cheque_No int,
BankDetails nvarchar(30),
P_UnitPrice money,
P_Price money
)

-- Creating trigger of above stored procedure to update or insert the stock as needed
Create Procedure StockProc
(@EnvType nvarchar(50),@TypeSize nvarchar(50),@Size nvarchar(50),@Desc Sql_variant,@Qty    int,@Quality int)
As Begin

if exists (select S.EnvType, S.TypeSize, S.Size, S.[Description], S.Qty, S.Quality
from NewProduct NP Full Join Stock S
on(NP.Size=NP.Size)
where NP.Size=@Size and NP.TypeSize=@TypeSize and NP.EnvType=@EnvType and  NP.Quality=@Quality)
    --Print 'Record Found';
--If Record will found then ut will update the quantity
Begin
    update Stock
    set Qty=NP.Qty+S.Qty
    from NewProduct NP, Stock S
    --have not used IN Operator here as IN works as OR Clause
    where S.EnvType=NP.EnvType and S.TypeSize=NP.TypeSize and S.Size=NP.Size
End
Else
--If no record will match with the enterd data, New Record will be added on Stock Table
Begin
    --Print 'No Record Found'
    insert into Stock (EnvType, TypeSize, Size, [Description], Qty, Quality)
                 values(@EnvType,@TypeSize,@Size,@Desc,@Qty,@Quality)
    --Below Lines will slow down the performance so we are using the above  query
    --Truncate Table Stock
    --insert into Stock (Date_of_Added, EnvType, TypeSize, Size, [Description], Qty, Quality)
    --select Date_of_Added, EnvType, TypeSize, Size, [Description], Qty, Quality from NewProduct
End
End

- 在sql中测试它可以正常工作,你可以通过下面的exec代码测试它

exec StockProc 'fdfdf','sdf','dsfs','sdf',4,5

C#代码:

private void cmdSave_Click(object sender, EventArgs e)
    {
        try
        {
            SqlCommand cmd = null;
            //Will check the connection state if got open then will close the connection
            if (ObjCon.con.State == ConnectionState.Open)
                ObjCon.con.Close();
            ObjCon.con.Open();

            string Query = "INSERT INTO NewProduct ([MS], [Date_of_Added], [Invoice_No], [Challan_No], [EnvType], [TypeSize], [Size],[Description], [Qty], [Quality], [PayState], [Balanace_Amount], [PaymentMode], [Cheque_No], [BankDetails], [P_UnitPrice], [P_Price])  VALUES ('" + txtMs.Text + "','" + dtpNewProduct.Value + "','" + txtInvoiceNo.Text + "','" + txtChallanNo.Text + "','" + cboType.Text + "','" + txtTypeSize1.Text + "X" + txtTypeSize2.Text + "','" + txtSize1.Text + "X" + txtSize2.Text + "','" + txtDesc.Text + "','" + nudQty.Value + "','" + nudQuality.Value + "','" + cboPayState.Text + "','" + txtBalAmt.Text + "','" + cboPayMode.Text + "','" + txtChequeNo.Text + "','" + txtBankNameBranch.Text + "','" + txtPUPrice.Text + "','" + txtPPrice.Text + "')";
            cmd = new SqlCommand(Query, ObjCon.con);
            cmd.ExecuteNonQuery();
            SqlCommand cmd2 = new SqlCommand("StockProc", ObjCon.con);
            //SqlCommand cmd2 = new SqlCommand("exec StockProc '" + cboType.Text + "','" + txtTypeSize1.Text + "X" + txtTypeSize2.Text + "','" + txtSize1.Text + "X" + txtSize2.Text + "','" + txtDesc.Text + "','" + nudQty.Value + "','" + nudQuality.Value + "'", ObjCon.con);
            cmd2.CommandType = CommandType.StoredProcedure;
            //cmd2.Parameters.Add(new SqlParameter("@Date_of_Added", dtpNewProduct.Value));
            cmd2.Parameters.Add(new SqlParameter("@EnvType", cboType.Text));
            cmd2.Parameters.Add(new SqlParameter("@TypeSize", txtTypeSize1.Text + "X" + txtTypeSize2.Text));
            cmd2.Parameters.Add(new SqlParameter("@Size", txtSize1.Text + "X" + txtSize2.Text));
            cmd2.Parameters.Add(new SqlParameter("@Desc", txtDesc.Text));
            cmd2.Parameters.Add(new SqlParameter("@Qty", nudQty.Value));
            cmd2.Parameters.Add(new SqlParameter("@Quality", nudQuality.Value));

            //http://www.java2s.com/Tutorial/CSharp/0560__ADO.Net/Callstoredprocedureandpassintheparameter.htm
            //cmd2.Parameters.Add(new SqlParameter("@EnvType", SqlDbType.NVarChar)).Value = cboType.Text;
            //cmd2.Parameters.Add(new SqlParameter("@TypeSize", SqlDbType.NVarChar)).Value = txtTypeSize1.Text + "X" + txtTypeSize2.Text;
            //cmd2.Parameters.Add(new SqlParameter("@Size", SqlDbType.NVarChar )).Value=txtSize1.Text + "X" + txtSize2.Text;
            //cmd2.Parameters.Add(new SqlParameter("@Desc", SqlDbType.Variant)).Value=txtDesc.Text;
            //cmd2.Parameters.Add(new SqlParameter("@Qty",SqlDbType.Int)).Value= nudQty.Value;
            //cmd2.Parameters.Add(new SqlParameter("@Quality", SqlDbType.Int)).Value = nudQuality.Value;

            //SqlDataReader dr = cmd2.ExecuteReader();
            //if (dr.HasRows)
            //    MessageBox.Show("FOUND")
            //if (dr.IsClosed == false)
            //{
            //    dr.Close();
            //}
            //dr.Read();
            //cmd2.ExecuteScalar();
            //cmd2.ExecuteNonQuery();
            //set Asynchronous Processing=true in conneciton String in order to use BeginExecureNonQuery Method
            //cmd2.BeginExecuteNonQuery();
            //if (cmd2.ExecuteNonQuery() > 0)
               // MessageBox.Show("FOUND");
            //dr.Close();
            ObjCon.con.Close();
            MessageBox.Show("Your Details has been Saved\rThank You", "Save", MessageBoxButtons.OK, MessageBoxIcon.Information);
            this.Close();
        }
        catch (Exception ex)
        {
            MessageBox.Show("The Following Error Occur" + ex.ToString(), "Error", MessageBoxButtons.OK, MessageBoxIcon.Error);
            this.Close();
        }
    }

请帮助......

或者您认为我应该使用UDF而不是存储过程

2 个答案:

答案 0 :(得分:0)

在c#代码中,选中“字符串查询”,在值后写入错误。

e.g。使用cmd参数时,请使用@ms而不是控件名称。

答案 1 :(得分:0)

首先,我相信该错误存储在您的存储过程StockProc中。使用此更改(我在此处分配意图,因此您可能需要对其进行调整):

create Procedure StockProc
(@EnvType nvarchar(50),@TypeSize nvarchar(50),@Size nvarchar(50),@Desc Sql_variant,@Qty    int,@Quality int)
As Begin

if exists (select S.EnvType, S.TypeSize, S.Size, S.[Description], S.Qty, S.Quality
from NewProduct NP inner Join Stock S
on(NP.Size=S.Size)
where NP.Size=@Size and NP.TypeSize=@TypeSize and NP.EnvType=@EnvType and  NP.Quality=@Quality)
--If Record will found then ut will update the quantity
Begin
    Print 'Record Found';
    update Stock
    set Qty=NP.Qty+S.Qty
    from NewProduct NP, Stock S
    --have not used IN Operator here as IN works as OR Clause
    where S.EnvType=NP.EnvType and S.TypeSize=NP.TypeSize and S.Size=NP.Size
End
Else
--If no record will match with the enterd data, New Record will be added on Stock Table
Begin
    Print 'No Record Found'
    insert into Stock (EnvType, TypeSize, Size, [Description], Qty, Quality)
                 values(@EnvType,@TypeSize,@Size,@Desc,@Qty,@Quality)
    --Below Lines will slow down the performance so we are using the above  query
    --Truncate Table Stock
    --insert into Stock (Date_of_Added, EnvType, TypeSize, Size, [Description], Qty, Quality)
    --select Date_of_Added, EnvType, TypeSize, Size, [Description], Qty, Quality from NewProduct
End
End
GO

现在,您的C#代码。根据我的意见,请遵循处理连接的最佳做法a.s.a.p。:

    private void cmdSave_Click(object sender, EventArgs e)
    {
        try
        {
            using (var con = new SqlConnection(ObjCon.con.ConnectionString))
            {
                // I assume this was just for testing to show a direct INSERT works when the sproc didn't.
                // Otherwise, I'd be using replaceable parameters rather than straight text values as that
                // makes it quite vulnerable to SQL injection attacks. Better yet, make this a sproc as well
                // and use it rather than client-side SQL.
                var query =
                    "INSERT INTO NewProduct ([MS], [Date_of_Added], [Invoice_No], [Challan_No], [EnvType], [TypeSize], [Size],[Description], [Qty], [Quality], [PayState], [Balanace_Amount], [PaymentMode], [Cheque_No], [BankDetails], [P_UnitPrice], [P_Price])  VALUES ('"
                    + txtMs.Text + "','" + dtpNewProduct.Value + "','" + txtInvoiceNo.Text + "','"
                    + txtChallanNo.Text + "','" + cboType.Text + "','" + txtTypeSize1.Text + "X" + txtTypeSize2.Text
                    + "','" + txtSize1.Text + "X" + txtSize2.Text + "','" + txtDesc.Text + "','" + nudQty.Value
                    + "','" + nudQuality.Value + "','" + cboPayState.Text + "','" + txtBalAmt.Text + "','"
                    + cboPayMode.Text + "','" + txtChequeNo.Text + "','" + txtBankNameBranch.Text + "','"
                    + txtPUPrice.Text + "','" + txtPPrice.Text + "')";

                using (var cmd = new SqlCommand(query, con))
                {
                    con.Open();
                    cmd.ExecuteNonQuery();
                }
            }

            using (var con = new SqlConnection(ObjCon.con.ConnectionString))
            using (var cmd2 = new SqlCommand("StockProc", con))
            {
                cmd2.CommandType = CommandType.StoredProcedure;
                //cmd2.Parameters.Add(new SqlParameter("@Date_of_Added", dtpNewProduct.Value));
                cmd2.Parameters.Add(new SqlParameter("@EnvType", cboType.Text));
                cmd2.Parameters.Add(new SqlParameter("@TypeSize", txtTypeSize1.Text + "X" + txtTypeSize2.Text));
                cmd2.Parameters.Add(new SqlParameter("@Size", txtSize1.Text + "X" + txtSize2.Text));
                cmd2.Parameters.Add(new SqlParameter("@Desc", txtDesc.Text));
                cmd2.Parameters.Add(new SqlParameter("@Qty", nudQty.Value));
                cmd2.Parameters.Add(new SqlParameter("@Quality", nudQuality.Value));

                //http://www.java2s.com/Tutorial/CSharp/0560__ADO.Net/Callstoredprocedureandpassintheparameter.htm
                //cmd2.Parameters.Add(new SqlParameter("@EnvType", SqlDbType.NVarChar)).Value = cboType.Text;
                //cmd2.Parameters.Add(new SqlParameter("@TypeSize", SqlDbType.NVarChar)).Value = txtTypeSize1.Text + "X" + txtTypeSize2.Text;
                //cmd2.Parameters.Add(new SqlParameter("@Size", SqlDbType.NVarChar )).Value=txtSize1.Text + "X" + txtSize2.Text;
                //cmd2.Parameters.Add(new SqlParameter("@Desc", SqlDbType.Variant)).Value=txtDesc.Text;
                //cmd2.Parameters.Add(new SqlParameter("@Qty",SqlDbType.Int)).Value= nudQty.Value;
                //cmd2.Parameters.Add(new SqlParameter("@Quality", SqlDbType.Int)).Value = nudQuality.Value;

                con.Open();
                cmd2.ExecuteNonQuery();
            }

            MessageBox.Show("Your Details has been Saved\rThank You", "Save", MessageBoxButtons.OK, MessageBoxIcon.Information);
            this.Close();
        }
        catch (Exception ex)
        {
            MessageBox.Show("The Following Error Occurred" + ex, "Error", MessageBoxButtons.OK, MessageBoxIcon.Error);
            this.Close();
        }
    }