CODEWITHSUNDEEP
c#entity-frameworkasp.net-core
Parvez
Parvez

Reputation: 187

Pass integer array to the SQL Server stored procedure

Well this well answered question however I can't get it right for me. What I am trying to do call a stored procedure from .NET Core project using Entity Framework with some parameters. One of those parameter should be array (which I consider table type in SQL Server by create a custom table data type) type. I followed this Stackoverflow link. But got an error when I tried to execute my SQL command.

Here is my code:

DataTable dt = new DataTable();
dt.Columns.Add("ID", typeof(int));

foreach (var section in model.VMSectionIds) //model.VMSectionIds contains set of integers
{
    dt.Rows.Add(section);
}

and finally I call stored procedure like this:

var sectiolist = new SqlParameter("@Sections", SqlDbType.Structured)
            {
                TypeName = "[dbo].[SectionList]",
                Value = dt
            };
_db.ExecuteSqlCommand("EXEC [SP_GenerateRegularEmployeeSalary] "+mastermodel.ID+","+ fromdate + "," + todate + ",1," + sectiolist + ""); //don't worry I took care of SQL injection for others parameter

But this execution throws an exception

SqlException: Must declare the scalar variable "@Sections"

I can't figure it out where exact problem is. Here call of stored procedure (with some static test parameter) from SQL for clear understanding of my stored procedure call mechanism:

DECLARE @data [SectionList]
INSERT @data (Id) VALUES (2, 3)

EXEC [SP_GenerateRegularEmployeeSalary] 2,'20190401','20190430','1',@data

Upvotes: 0

Views: 1682

Answers (2)

George Mahusay
George Mahusay

Reputation: 51

he using ExecuteSqlCommand incorrectly. he should not used string concatenation to avoid SQL Injection attacks in th application

_db.ExecuteSqlCommand("EXEC SP_GenerateRegularEmployeeSalary @YOUR_PARAM_ON_STOREPROCEDURE", sectiolist);

Upvotes: 1

Flavio Francisco
Flavio Francisco

Reputation: 775

Looks that you are using the ExecuteSqlCommand incorrectly. Try this way and don't use string concatenation in your code to avoid SQL Injection attacks in your application. Read more about it here.

Also put the correct expected parameter names from the stored procedure: SP_GenerateRegularEmployeeSalary.

Option 1

_db.ExecuteSqlCommand("EXEC [SP_GenerateRegularEmployeeSalary] @ID, @FromDate, @ToDate, @Flag, @Sections", 
   new SqlParameter("@ID", mastermodel.ID),
   new SqlParameter("@FromDate", fromdate),
   new SqlParameter("@ToDate", todate),
   new SqlParameter("@Flag", 1),
   new SqlParameter("@Sections", sectiolist));

Option 2

_db.ExecuteSqlCommand("EXEC [SP_GenerateRegularEmployeeSalary] @ID = {0}, @FromDate = {1}, @ToDate = {2}, @Flag = 1, @Sections = {4}", mastermodel.ID, fromdate, todate, sectiolist);

Please read this documentation about this method.

Upvotes: 1

Related Questions