ODBC Call Failed with stored procedure – Pass through query

To get more information about the cause of an “ODBC–call failed.” error we can loop through the DBEngine.Errors collection and see if there are other messages that might be a bit more descriptive. For example, with the code qdf.Connect = strConnectionString qdf.SQL = ” EXEC [dbo].[SAMPLE_TEST]” qdf.ReturnsRecords = True On Error GoTo oops Set rst … Read more

How to cleanse (prevent SQL injection) dynamic SQL in SQL Server?

I believe there are three different cases that you have to worry about: strings (anything that requires quotes): ”” + replace(@string, ””, ”””) + ”” names (anything where quotes aren’t allowed): quotename(@string) things that cannot be quoted: this requires whitelisting Note: Everything in a string variable (char, varchar, nchar, nvarchar, etc.) that comes from user-controlled … Read more

Call stored procedure with table-valued parameter from java

This is documented here in the JDBC driver manual. In your case, you’d have to do this: try (SQLServerCallableStatement stmt = (SQLServerCallableStatement) con.prepareCall(“{call test(?)}”)) { SQLServerDataTable table = new SQLServerDataTable(); sourceDataTable.addColumnMetadata(“n”, java.sql.Types.INTEGER); sourceDataTable.addRow(9); sourceDataTable.addRow(12); sourceDataTable.addRow(27); sourceDataTable.addRow(37); stmt.setStructured(1, “dbo.integer_list_tbltype”, table); } I’ve also recently documented this in an article.

Bulk insert using stored procedure

There’s nothing wrong with your stored procedure code – the point is: the BULK INSERT command cannot accept a file name as a variable. This does work: BULK INSERT ZIPCodes FROM ‘e:\5-digit Commercial.csv’ WITH but this never works – within a stored proc or not: DECLARE @filename VARCHAR(255) SET @filename=”e:\5-digit Commercial.csv” BULK INSERT ZIPCodes FROM … Read more

How to use a DataAdapter with stored procedure and parameter

I got it!…hehe protected DataTable RetrieveEmployeeSubInfo(string employeeNo) { SqlCommand cmd = new SqlCommand(); SqlDataAdapter da = new SqlDataAdapter(); DataTable dt = new DataTable(); try { cmd = new SqlCommand(“RETRIEVE_EMPLOYEE”, pl.ConnOpen()); cmd.Parameters.Add(new SqlParameter(“@EMPLOYEENO”, employeeNo)); cmd.CommandType = CommandType.StoredProcedure; da.SelectCommand = cmd; da.Fill(dt); dataGridView1.DataSource = dt; } catch (Exception x) { MessageBox.Show(x.GetBaseException().ToString(), “Error”, MessageBoxButtons.OK, MessageBoxIcon.Error); } finally { … Read more