SQL Clone
SQLServerCentral is supported by Redgate
 
Log in  ::  Register  ::  Not logged in
 
 
 


error in stored procedure


error in stored procedure

Author
Message
ssurekha2000
ssurekha2000
SSC-Enthusiastic
SSC-Enthusiastic (143 reputation)SSC-Enthusiastic (143 reputation)SSC-Enthusiastic (143 reputation)SSC-Enthusiastic (143 reputation)SSC-Enthusiastic (143 reputation)SSC-Enthusiastic (143 reputation)SSC-Enthusiastic (143 reputation)SSC-Enthusiastic (143 reputation)

Group: General Forum Members
Points: 143 Visits: 207
ALTER PROCEDURE [dbo].[usp_delete] @tablename sysname, @pid int
,@pidname varchar(10)

AS
DECLARE @SQL varchar(500)

SET @SQL = 'delete from ' + @tablename + ' where '+ @pidname + ' = '+ @pid


Conversion failed when converting the nvarchar value 'delete from m_customer where cid = ' to data type int.

i get the above error

if i convert pid int to varchar i dont get error but the recod is not deleted

whts the best way toprevent sql injection and have database secured
WolfgangE
WolfgangE
SSC-Addicted
SSC-Addicted (479 reputation)SSC-Addicted (479 reputation)SSC-Addicted (479 reputation)SSC-Addicted (479 reputation)SSC-Addicted (479 reputation)SSC-Addicted (479 reputation)SSC-Addicted (479 reputation)SSC-Addicted (479 reputation)

Group: General Forum Members
Points: 479 Visits: 792
To make your statement work you have to convert @pid in the string concatenation.

SET @SQL = 'delete from ' + @tablename + ' where '+ @pidname + ' = '+ cast( @pid as varchar(50) )

To avoid sql injection you should not use dynamic statements like this at all. Write a separate delete procedure for every table where you want to delete data from.
kapil_kk
kapil_kk
Hall of Fame
Hall of Fame (3.1K reputation)Hall of Fame (3.1K reputation)Hall of Fame (3.1K reputation)Hall of Fame (3.1K reputation)Hall of Fame (3.1K reputation)Hall of Fame (3.1K reputation)Hall of Fame (3.1K reputation)Hall of Fame (3.1K reputation)

Group: General Forum Members
Points: 3091 Visits: 2766
first ensure that the value you are getting in @pid is int or varchar. If column data type is varchar then use CAST for it.
Hope, It will works for you :-P

_______________________________________________________________
To get quick answer follow this link:
http://www.sqlservercentral.com/articles/Best+Practices/61537/
Sean Pearce
Sean Pearce
SSCommitted
SSCommitted (1.8K reputation)SSCommitted (1.8K reputation)SSCommitted (1.8K reputation)SSCommitted (1.8K reputation)SSCommitted (1.8K reputation)SSCommitted (1.8K reputation)SSCommitted (1.8K reputation)SSCommitted (1.8K reputation)

Group: General Forum Members
Points: 1778 Visits: 3432
ALTER PROCEDURE [dbo].[usp_delete]
@tablename sysname,
@pid int,
@pidname varchar(10)
AS

DECLARE @SQL NVARCHAR(MAX),
@Params NVARCHAR(MAX);

SELECT @SQL = 'DELETE FROM [' + @tablename + '] WHERE ' + @pidname + ' = @pid;',
@Params = '@pid INT';

EXEC sp_executesql @SQL, @Params, @pid = @pid;





The SQL Guy @ blogspot

@SeanPearceSQL

About Me
Eugene Elutin
Eugene Elutin
SSCarpal Tunnel
SSCarpal Tunnel (5K reputation)SSCarpal Tunnel (5K reputation)SSCarpal Tunnel (5K reputation)SSCarpal Tunnel (5K reputation)SSCarpal Tunnel (5K reputation)SSCarpal Tunnel (5K reputation)SSCarpal Tunnel (5K reputation)SSCarpal Tunnel (5K reputation)

Group: General Forum Members
Points: 4992 Visits: 5478
Sean Pearce (12/11/2012)
ALTER PROCEDURE [dbo].[usp_delete]
@tablename sysname,
@pid int,
@pidname varchar(10)
AS

DECLARE @SQL NVARCHAR(MAX),
@Params NVARCHAR(MAX);

SELECT @SQL = 'DELETE FROM [' + @tablename + '] WHERE ' + @pidname + ' = @pid;',
@Params = '@pid INT';

EXEC sp_executesql @SQL, @Params, @pid = @pid;




Don't forget to test your sp by executing:


EXEC dbo].[usp_delete]
@tablename = 'sometable',
@pid int = 1,
@pidname = '1 = 1 OR 1 '



Cool

It's a good idea to always protect your dynamic sql from injection

_____________________________________________
"The only true wisdom is in knowing you know nothing"
"O skol'ko nam otkrytiy chudnyh prevnosit microsofta duh!":-D
(So many miracle inventions provided by MS to us...)

How to post your question to get the best and quick help
GilaMonster
GilaMonster
SSC Guru
SSC Guru (87K reputation)SSC Guru (87K reputation)SSC Guru (87K reputation)SSC Guru (87K reputation)SSC Guru (87K reputation)SSC Guru (87K reputation)SSC Guru (87K reputation)SSC Guru (87K reputation)

Group: General Forum Members
Points: 87491 Visits: 45272
I strongly recommend you do not go this approach of generic delete procedures.

Gail Shaw
Microsoft Certified Master: SQL Server, MVP, M.Sc (Comp Sci)
SQL In The Wild: Discussions on DB performance with occasional diversions into recoverability

We walk in the dark places no others will enter
We stand on the bridge and no one may pass


Sean Pearce
Sean Pearce
SSCommitted
SSCommitted (1.8K reputation)SSCommitted (1.8K reputation)SSCommitted (1.8K reputation)SSCommitted (1.8K reputation)SSCommitted (1.8K reputation)SSCommitted (1.8K reputation)SSCommitted (1.8K reputation)SSCommitted (1.8K reputation)

Group: General Forum Members
Points: 1778 Visits: 3432
Eugene Elutin (12/11/2012)
Sean Pearce (12/11/2012)
ALTER PROCEDURE [dbo].[usp_delete]
@tablename sysname,
@pid int,
@pidname varchar(10)
AS

DECLARE @SQL NVARCHAR(MAX),
@Params NVARCHAR(MAX);

SELECT @SQL = 'DELETE FROM [' + @tablename + '] WHERE ' + @pidname + ' = @pid;',
@Params = '@pid INT';

EXEC sp_executesql @SQL, @Params, @pid = @pid;




Don't forget to test your sp by executing:


EXEC dbo].[usp_delete]
@tablename = 'sometable',
@pid int = 1,
@pidname = '1 = 1 OR 1 '



Cool

It's a good idea to always protect your dynamic sql from injection


You can offer some protection by wrapping the execution statement.

ALTER PROCEDURE [dbo].[usp_delete]
@tablename sysname,
@pid int,
@pidname varchar(10)
AS

DECLARE @SQL NVARCHAR(MAX),
@Params NVARCHAR(MAX);

SELECT @SQL = 'DELETE FROM [' + @tablename + '] WHERE ' + @pidname + ' = @pid;',
@Params = '@pid INT';

IF EXISTS(SELECT * FROM sys.columns WHERE name = @pidname AND OBJECT_NAME(object_id) = @tablename)
BEGIN
EXEC sp_executesql @SQL, @Params, @pid = @pid;
END;





The SQL Guy @ blogspot

@SeanPearceSQL

About Me
Go


Permissions

You can't post new topics.
You can't post topic replies.
You can't post new polls.
You can't post replies to polls.
You can't edit your own topics.
You can't delete your own topics.
You can't edit other topics.
You can't delete other topics.
You can't edit your own posts.
You can't edit other posts.
You can't delete your own posts.
You can't delete other posts.
You can't post events.
You can't edit your own events.
You can't edit other events.
You can't delete your own events.
You can't delete other events.
You can't send private messages.
You can't send emails.
You can read topics.
You can't vote in polls.
You can't upload attachments.
You can download attachments.
You can't post HTML code.
You can't edit HTML code.
You can't post IFCode.
You can't post JavaScript.
You can post emoticons.
You can't post or upload images.

Select a forum

































































































































































SQLServerCentral


Search