January 11, 2012 at 5:17 am
My current code as following,
Dim sqlNm As String = ""
Dim sqlNm2 As String = ""
Dim strType As String = ""
Dim newSQL As String = ""
'~~~~~~~~~~~~~~~~~~~~~~~~~~~
Call cbfDataSQLDeclaration()
'~~~~~~~~~~~~~~~~~~~~~~~~~~~
'sqlNm = "select CONm,APId,BUId from tblwfcorules where coid = '" & COBiodataID & "'"
'norsan comment out the above code.Replace with stored proc below. 10/1/2012
sqlNm = ""
sqlNm = "EXECUTE sp_executesql N'EXEC dbo.spPRMWFCORulesByCOID ''" & Trim(COBiodataID) & "'''"
Try
dataSql.SelectData(connectionstring, dr, sqlNm, Nothing)
If Not dr Is Nothing Then
If dr.HasRows() Then
dr.Read()
apID = IIf(Convert.IsDBNull(dr("APId")), "", dr("APId").ToString)
buID = IIf(Convert.IsDBNull(dr("BUId")), "", dr("BUId").ToString)
End If
End If
dr.Close()
Catch ex As Exception : Log.HrmisLog(Page.AppRelativeVirtualPath, "SQL1", Security.GetUserIDBS, ex.Message, True, True, False)
Finally : Call cbfDataSQLDispose()
End Try
My question as following,
1. Did my technique is recommended?
FYI, in my SQL Server, wait Category on RESOURCE_SEMAPHORE_QUERY_COMPILE was really high
January 11, 2012 at 5:21 am
Avoid dynamic SQL, it is not clear here why you need to use it?
Also you do not need to place another EXEC[UTE] as part of the dynamic SQL you are executing.
e.g. EXECUTE sp_executesql N'SELECT 1'
You should use ado.net commands also.
Rob
January 11, 2012 at 9:14 am
Little Nick (1/11/2012)
My current code as following,
Dim sqlNm As String = ""
Dim sqlNm2 As String = ""
Dim strType As String = ""
Dim newSQL As String = ""
'~~~~~~~~~~~~~~~~~~~~~~~~~~~
Call cbfDataSQLDeclaration()
'~~~~~~~~~~~~~~~~~~~~~~~~~~~
'sqlNm = "select CONm,APId,BUId from tblwfcorules where coid = '" & COBiodataID & "'"
'norsan comment out the above code.Replace with stored proc below. 10/1/2012
sqlNm = ""
sqlNm = "EXECUTE sp_executesql N'EXEC dbo.spPRMWFCORulesByCOID ''" & Trim(COBiodataID) & "'''"
Try
dataSql.SelectData(connectionstring, dr, sqlNm, Nothing)
If Not dr Is Nothing Then
If dr.HasRows() Then
dr.Read()
apID = IIf(Convert.IsDBNull(dr("APId")), "", dr("APId").ToString)
buID = IIf(Convert.IsDBNull(dr("BUId")), "", dr("BUId").ToString)
End If
End If
dr.Close()
Catch ex As Exception : Log.HrmisLog(Page.AppRelativeVirtualPath, "SQL1", Security.GetUserIDBS, ex.Message, True, True, False)
Finally : Call cbfDataSQLDispose()
End Try
My question as following,
1. Did my technique is recommended?
FYI, in my SQL Server, wait Category on RESOURCE_SEMAPHORE_QUERY_COMPILE was really high
I wouldn't be usint this technique. Since you are calling stored procedure within your sp_executesql call I think you should be using a Command object with a CommandType of stored procedure and then using the Parameters collection to create and pass the parameter to the stored procedure. Basically something like this (I may have some syntax or class names wrong because I haven't been working in .NET the last 8 months):
DIM cmd as SQLCommand
cmd.Connection = [connection]
cmd.CommandType = storedprocedure
cmd.CommandText = "dbo.spPRMWFCORulesByCOID"
cmd.Parameters.Add("@COID", [Data Type], [Parameter Value]) ' I think this is one way to do the syntax
cmd.Execute
That's the general idea. Some of the syntax may not be right, but you should be able to figure it out. Since you aren't using parameters in your existing code or cleansing input you are leaving yourself open to SQL Injectino attacks.
Jack Corbett
Consultant - Straight Path Solutions
Check out these links on how to get faster and more accurate answers:
Forum Etiquette: How to post data/code on a forum to get the best help
Need an Answer? Actually, No ... You Need a Question
January 11, 2012 at 9:38 am
RESOURCE_SEMAPHORE_QUERY_COMPILE waits is high. My understanding, this nothing to do with my ASP.NET code technique
Let's, my same Stored Procedure is execute 500 a day. Did we have special technique to make it run efficiently?
January 11, 2012 at 10:07 am
Little Nick (1/11/2012)
RESOURCE_SEMAPHORE_QUERY_COMPILE waits is high. My understanding, this nothing to do with my ASP.NET code techniqueLet's, my same Stored Procedure is execute 500 a day. Did we have special technique to make it run efficiently?
Sure it does. You aren't using parameters so every call to sp_executesql is likely requiring a compilation. If you use parameters properly then you will more likely get plan re-use. Even ORM tools like Linq to SQL, EF, hibernate/nhibernate use parameters.
Plus, performance isn't your biggest problem in this case it is the security hole you leave open by using non-cleansed input to build a sql string.
From http://technet.microsoft.com/en-us/library/cc293620.aspx
Keep in mind that caching is done on a per-batch level. If you try to force parameterization using sp_executesql or Prepare/Execute, all the statements in the batch must be parameterized for the plan to be reusable. If a batch has some parameterized statements and some using constants, each execution of the batch with different constants will be considered distinct, and there will be no value to the parameterization in only part of the batch.
You might also want to read this post, http://blogs.msdn.com/b/sqlprogrammability/archive/2007/01/21/2-0-diagnosing-plan-cache-related-performance-problems-and-suggested-solutions.aspx
Jack Corbett
Consultant - Straight Path Solutions
Check out these links on how to get faster and more accurate answers:
Forum Etiquette: How to post data/code on a forum to get the best help
Need an Answer? Actually, No ... You Need a Question
January 11, 2012 at 11:52 am
tq sir
Viewing 6 posts - 1 through 5 (of 5 total)
You must be logged in to reply to this topic. Login to reply