Solved

Error message when passing criteria to Stored procedure via C#

Posted on 2008-09-29
13
233 Views
Last Modified: 2013-12-17
I am attempting to pass a Parameter to a stored procedure but get an error stating: Incorrect syntax near 'Report'.   If I excute the stored procedure with the same parameter string directly with SQL  server I do not get an error message.  My code is below.  Is it something with the double single quotes in my string?
sqlCommand.Parameters.AddWithValue("@selectFields",  Convert.ToString("b.[SystemId] as [fp_empno], ''Custom Report'' as reportTitle,  a.[Department] as CustomField0, '' '' AS CustomField1, '' '' AS CustomField2, '' '' AS CustomField3, '' '' AS CustomField4, ''Department'' as CustomLabel0, '' '' AS CustomLabel1, '' '' AS CustomLabel2, '' '' AS CustomLabel3, '' '' AS CustomLabel4 "));
 

                    SqlDataAdapter dataAdapter = new SqlDataAdapter();

                    dataAdapter.SelectCommand = sqlCommand;

                    dataAdapter.Fill(ds,"Search");

Open in new window

0
Comment
Question by:eshurak
  • 6
  • 4
  • 2
  • +1
13 Comments
 
LVL 32

Expert Comment

by:Daniel Wilson
Comment Utility
>>Is it something with the double single quotes in my string?

I think so.  Try dropping them to single single quotes.
0
 
LVL 3

Author Comment

by:eshurak
Comment Utility
When I tried that I got the following error message:

An object or column name is missing or empty. For SELECT INTO statements, verify each column has a name. For other statements, look for empty alias names. Aliases defined as "" or [] are not allowed. Add a name or single space as the alias name.

SQL Server needs the double single qoutes, but C# does not seem to like them.
0
 
LVL 32

Expert Comment

by:Daniel Wilson
Comment Utility
would you post the procedure that uses that parameter?
0
 
LVL 3

Author Comment

by:eshurak
Comment Utility
The procedure is not relevent it's a c# issue as the procedure itself accepts the same string.
0
 
LVL 32

Expert Comment

by:Daniel Wilson
Comment Utility
SQL Server is throwing the error.

If you can't post the procedure, can you at least confirm that the parameter is being used as a portion of a dynamic SQL statement?

With that in mind ... would you try this?

sqlCommand.Parameters.AddWithValue("@selectFields",  Convert.ToString("'b.[SystemId] as [fp_empno], ''Custom Report'' as reportTitle,  a.[Department] as CustomField0, '' '' AS CustomField1, '' '' AS CustomField2, '' '' AS CustomField3, '' '' AS CustomField4, ''Department'' as CustomLabel0, '' '' AS CustomLabel1, '' '' AS CustomLabel2, '' '' AS CustomLabel3, '' '' AS CustomLabel4 '"));

Open in new window

0
 
LVL 3

Author Comment

by:eshurak
Comment Utility
I don't get the error, but it the dataset does not contain any data now.
0
Maximize Your Threat Intelligence Reporting

Reporting is one of the most important and least talked about aspects of a world-class threat intelligence program. Here’s how to do it right.

 
LVL 14

Expert Comment

by:CyrexCore2k
Comment Utility
Using a sproc to execute dynamic sql kind of defeats the purpose...

Why not just execute the query itself and save yourself the trouble?
0
 
LVL 3

Author Comment

by:eshurak
Comment Utility
The sproc returns values from several sources.  In addition to criteria I am passing it the fields (@selectFields) to be returned as choosen by the user.  This creates a dynamic custom report in crystal.  But at this point I'm going to scrap the selectfields part and have the sproc return all fields and use C# to drop the fields I don't need from the dataset and have it return several other ones.

Thanks guys.
0
 
LVL 26

Expert Comment

by:Anurag Thakur
Comment Utility
the query sent by you is the issue as its not a well formed query
your query contains lines like this (copying only a part of the line)

'' '' AS CustomField4 -- what does this line mean to sql

select '' '' AS CustomField4 -- if you jsut run this line you get error

An object or column name is missing or empty. For SELECT INTO statements, verify each column has a name. For other statements, look for empty alias names. Aliases defined as "" or [] are not allowed. Add a name or single space as the alias name.

this is because you are saying select this column and the output column name will be CustomField4 but what column to select?

Can you please tell us what you are trying to achieve so that we can help better
0
 
LVL 32

Expert Comment

by:Daniel Wilson
Comment Utility
Obviously you're doubling up the quotes for use w/ dynamic SQL.

We need to see the procedure, I'm afraid, in order to say how best to do that.
0
 
LVL 32

Expert Comment

by:Daniel Wilson
Comment Utility
Hold on, looks like some escape sequences may solve this ...
http://blogs.msdn.com/csharpfaq/archive/2004/03/12/88415.aspx


sqlCommand.Parameters.AddWithValue("@selectFields",  Convert.ToString("b.[SystemId] as [fp_empno], \'\'Custom Report\'\' as reportTitle,  a.[Department] as CustomField0, \'\' \'\' AS CustomField1, \'\' \'\' AS CustomField2, \'\' \'\' AS CustomField3, \'\' \'\' AS CustomField4, \'\'Department\'\' as CustomLabel0, \'\' \'\' AS CustomLabel1, \'\' \'\' AS CustomLabel2, \'\' \'\' AS CustomLabel3, \'\' \'\' AS CustomLabel4 "));

Open in new window

0
 
LVL 26

Expert Comment

by:Anurag Thakur
Comment Utility
whatever you do with escape sequences but this line will always going to thorw an error
\'\' \'\' AS CustomField1

Select '' '' AS CustomField1
0
 
LVL 32

Accepted Solution

by:
Daniel Wilson earned 500 total points
Comment Utility
You double up the single quotes when building a string to use as a dynamic SQL statement.  That's how T-SQL escapes them.

So ...

Declare @MyString varchar(8000)
set @MyString= 'Select '' '' AS CustomField1'
Exec (@MyString)

... is the same as ...

Select ' ' AS CustomField1

... and we're all comfortable with that.
0

Featured Post

Why You Should Analyze Threat Actor TTPs

After years of analyzing threat actor behavior, it’s become clear that at any given time there are specific tactics, techniques, and procedures (TTPs) that are particularly prevalent. By analyzing and understanding these TTPs, you can dramatically enhance your security program.

Join & Write a Comment

Suggested Solutions

Title # Comments Views Activity
Where to begin studying? 5 63
Code enhancement 5 12
Chat Room 1 22
Spacing between controls 4 15
Today I had a very interesting conundrum that had to get solved quickly. Needless to say, it wasn't resolved quickly because when we needed it we were very rushed, but as soon as the conference call was over and I took a step back I saw the correct …
A long time ago (May 2011), I have written an article showing you how to create a DLL using Visual Studio 2005 to be hosted in SQL Server 2005. That was valid at that time and it is still valid if you are still using these versions. You can still re…
This tutorial demonstrates a quick way of adding group price to multiple Magento products.
You have products, that come in variants and want to set different prices for them? Watch this micro tutorial that describes how to configure prices for Magento super attributes. Assigning simple products to configurable: We assigned simple products…

762 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

7 Experts available now in Live!

Get 1:1 Help Now