尝试执行存储过程时出现意外错误

Question

当我尝试执行特定的存储过程时，我收到以下异常：

Input string was in incorrect format

---

我的.cs：

 sQuery.Append("EXECUTE procedure get_department(" + dep_code + "," + emp_code + "," + batch_code + ")");
 return DAL_Helper.Return_DataTable(sQuery.ToString());

---

我调试并确保所有参数都是intger。

   public DataTable Return_DataTable(string cmdText)
    {
        Open_Connection();
        DataTable dt = new DataTable();
        command.CommandText = cmdText;
        command.CommandType = CommandType.Text;
        command.Connection = connection;
        try
        {
            dt.Load(command.ExecuteReader());
        }
        catch (IfxException ifxEx)// Handle IBM.data.informix : mostly catched
        {
            ErrMapping.WriteLog("\r\n Error Code: " + ifxEx.Errors[0].NativeError.ToString() +
                                "\r\n MEssage: " + ifxEx.Errors[0].Message);
            throw new Exception("ERROR:" + ifxEx.Errors[0].NativeError.ToString() +
                                "\r\n MEssage: " + ifxEx.Errors[0].Message);
        }
        catch (Exception ex)// Handle all other exceptions.
        {
            ErrMapping.WriteLog("\r\n Error Message: " + ex.Message);
            throw new Exception("\r\n Error Message: " + ex.Message);
        }
        finally
        {
            Close_Connection();
        }
        return dt;
    }

---

编辑1：

public DataTable Return_DataTable(string cmdText, CommandType cmdType, Dictionary<string, string> Param_arr)
        {
            Open_Connection();
            int return_val = -1;
            DataTable dt = new DataTable();
            command.CommandText = cmdText;
            command.CommandType = cmdType;
            if (cmdType == CommandType.StoredProcedure)
            {
                if (Param_arr != null)
                {
                    command.Parameters.Clear();
                    if (Param_arr.Count > 0)
                    {
                        for (IEnumerator<KeyValuePair<string, string>> enumerator = Param_arr.GetEnumerator(); enumerator.MoveNext(); )
                        {
                            param = command.CreateParameter();
                            param.ParameterName = enumerator.Current.Key.ToString();
                            param.Value = enumerator.Current.Value.ToString();
                            command.Parameters.Add(param);
                        }
                    }
                }
            }
            IfxDataReader dr2;
            try
            {
                dr2 = command.ExecuteReader();
                dt.Load(dr2);
            }
            catch (IfxException ifxEx)// Handle IBM.data.informix : mostly catched
            {
                ErrMappingForInformix.WriteLog("\r\n Error Code: " + ifxEx.Errors[0].NativeError.ToString() +
                                    "\r\n MEssage: " + ifxEx.Errors[0].Message);
                throw new Exception("ERROR:" + ifxEx.Errors[0].NativeError.ToString() +
                                    "\r\n MEssage: " + ifxEx.Errors[0].Message);
            }
            catch (Exception ex)// Handle all other exceptions.
            {
                ErrMappingForInformix.WriteLog("\r\n Error Message: " + ex.Message);
                throw new Exception("\r\n Error Message: " + ex.Message);
            }
            finally
            {
                Close_Connection();
            }
            return dt;
        }

Answer 1

这个怎么样：

command.CommandText = "get_department";
command.CommandType = CommandType.StoredProcedure;
cmd.Parameters.Add(new SqlParameter("dep_code", dep_code));
cmd.Parameters.Add(new SqlParameter("emp_code", emp_code));
cmd.Parameters.Add(new SqlParameter("batch_code", batch_code));

查看this article中的不同示例（更具体地说：清单4.使用参数执行存储过程）。

以下代码行：

sQuery.Append("EXECUTE procedure get_department(" + dep_code + "," + emp_code + "," + batch_code + ")");

就像绝望的尝试打破一切，容易受到SQL注入攻击。 从不在构建SQL查询时使用字符串连接。

Answer 2

我知道你不需要写'过程'和括号：

"EXECUTE get_department" + dep_code + "," + emp_code + "," + batch_code

http://msdn.microsoft.com/en-us/library/ms188332.aspx