使用动态sql文本无法正确运行存储过程

Question

出于某种原因,我的存储过程在C#中没有任何代码隐藏错误的情况下执行,但它并没有删除存储过程所写的任何内容.我有所有正确的参数和一切.我使用C#代码中的所有相同参数从SQL Server运行查询,它运行正常.当我从SQL Server运行时,我不明白为什么它工作,但是当我从Visual Studio中的C#代码运行它时它不起作用.

这是我的C#代码,它将数据传递给存储过程.

string reportType = "PostClaim";
string GRNBRs = "925','926','927";
string PUNBRs = "100','100','100";
string beginningDates = "20120401";
string endDates= "20120430";

try
{
    conn = new SqlConnection(ConnectionInfo);
    conn.Open();
    SqlDataAdapter da = new SqlDataAdapter("RemoveReport", conn);
    da.SelectCommand.CommandType = CommandType.StoredProcedure;
    da.SelectCommand.Parameters.AddWithValue("@ReportType", reportType);
    da.SelectCommand.Parameters.AddWithValue("@GRNBR", GRNBRs);
    da.SelectCommand.Parameters.AddWithValue("@PUNBR", PUNBRs);
    da.SelectCommand.Parameters.AddWithValue("@DATE1", beginningDates);
    da.SelectCommand.Parameters.AddWithValue("@DATE2", endDates);
    da.SelectCommand.CommandTimeout = 360;
}
catch (SqlException ex)
{
    //something went wrong
    throw ex;
}
finally
{
    if (conn.State == ConnectionState.Open)
        conn.Close();
}

这是我的存储过程.它正在使用动态SQL文本执行.

ALTER PROCEDURE [dbo].[RemoveReport] (
    @ReportType NVARCHAR(20),
    @GRNBR VARCHAR(4000),
    @PUNBR VARCHAR(4000),
    @DATE1 DATETIME,
    @DATE2 DATETIME
)
AS

DECLARE @SQLTEXT VARCHAR(4000)
BEGIN

SET @SQLTEXT = 'DELETE FROM TestingTable
            WHERE Report='''+@ReportType+''' AND
            PUNBR IN ('''+@PUNBR+''') AND
            [Group] IN ('''+@GRNBR+''') AND
            StartedAt BETWEEN '''+CONVERT(VARCHAR(10),@DATE1,121)+'''
            AND '''+CONVERT(VARCHAR(10),@DATE2,121)+''''

PRINT @SQLTEXT  <---I'll print this out to show you what exactly it is executing.
EXECUTE (@SQLTEXT)
END

这是PRINT @SQLTEXT正在运行的:

DELETE FROM MonthlyReportSchedule
WHERE Report='PostClaim' AND
      PUNBR IN ('100','100','100') AND
      [Group] IN ('925','926','927') AND
      StartedAt BETWEEN '2012-04-01' AND '2012-04-30'

当我真正进入SQL Server运行此查询时,它完美地工作.但是为什么它从C#代码执行时不起作用.有帮助吗？

Answer 1

避免将参数连接到 sql，使用参数化查询，

尝试这个...

刚刚注意到你在参数中有一些逗号分隔的列表......

ALTER PROCEDURE [dbo].[RemoveReport]
    @ReportType NVARCHAR(20),
    @GRNBR VARCHAR(4000),
    @PUNBR VARCHAR(4000),
    @DATE1 DATETIME,
    @DATE2 DATETIME
AS
BEGIN
  SET NOCOUNT ON;

    DECLARE @SQLTEXT NVARCHAR(MAX);

   Declare @GRNBR_xml xml,@PUNBR_xml xml;

  SET @GRNBR_xml = N'<root><r>' + replace(@GRNBR, ',','</r><r>') + '</r></root>';
  SET @PUNBR_xml = N'<root><r>' + replace(@PUNBR, ',','</r><r>') + '</r></root>';


SET @SQLTEXT = N'DELETE FROM TestingTable
            WHERE Report = @ReportType
              AND PUNBR IN (select r.value(''.'',''varchar(max)'') as item
                            from @PUNBR_xml.nodes(''//root/r'') as records(r)) 
              AND [Group] IN (select r.value(''.'',''varchar(max)'') as item
                              from @GRNBR_xml.nodes(''//root/r'') as records(r)) 
              AND StartedAt BETWEEN @DATE1 AND @DATE2'

EXECUTE sp_executesql @SQLTEXT
                     ,N'@ReportType NVARCHAR(20) , @GRNBR_xml xml,
                       @PUNBR_xml xml,@DATE1 DATETIME,@DATE2 DATETIME'
                      ,@ReportType
                      ,@GRNBR_xml
                      ,@PUNBR_xml
                      ,@DATE1
                      ,@DATE2
END

笔记

确保将逗号分隔列表传递为925,926,927而不是作为'925','926','927'