调用存储过程后执行查询

Question

This is my stored procedure

CREATE DEFINER=`root`@`localhost` PROCEDURE `sp_CPC`(
    IN _B VARCHAR(100),
    IN _G      VARCHAR(2),     
    IN _R VARCHAR(30), 
    IN _D VARCHAR(30), 
    OUT _C FLOAT, 
    OUT _P FLOAT)
BEGIN
  //Something Hear
END$$
DELIMITER ;

I Call this stored procedure by C# flowing Code

DataSet tmpDataSet = new DataSet();
mCommand.CommandText = "sp_CPC";
mCommand.CommandType = CommandType.StoredProcedure;
// mCommand.CommandText = "sp_select_all_employees";
mCommand.Parameters.AddWithValue("@_B", "bty-23");
mCommand.Parameters.AddWithValue("@_G", "3");
mCommand.Parameters.AddWithValue("@_R", "9000");
mCommand.Parameters.AddWithValue("@_D", "92");

mCommand.Parameters.Add("@_C",MySqlDbType.Float);
mCommand.Parameters["@_C"].Direction = ParameterDirection.Output;
mCommand.Parameters.Add("@_P", MySqlDbType.Float);
mCommand.Parameters["@_P"].Direction = ParameterDirection.Output;

try
{
    mConnection.Open();
    mCommand.ExecuteNonQuery();
    mAdapter.Fill(tmpDataSet)
}
catch (Exception ex)
{
    strErrorInfo = ex.ToString();
}
finally
{
    mConnection.Close();
}
DataTable dtb = tmpDataSet.Tables[0];
         mCommand.CommandText = "INSERT INTO abc (xxxx,yyyy) VALUES ('" + dtb.Rows[0][0] + "','" + dtb.Rows[0][1] + "')";           
         mConnection.Open();
         mCommand.ExecuteNonQuery();     
         mConnection.Close();
return tmpDataSet;

it show error in this command mCommand.ExecuteNonQuery(); You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '-14' AND name LIKE '5378377032052','6'' at line 1.

(Return tmpDataSet) use Because of this data i also use anouther work

Answer 1

The way you construct the INSERT statement is unsafe. You concatenate strings that might contain ' characters, so that your INSERT statement becomes invalid - and also prone to SQL injection attacks. The error message you show in the comments points in this direction.

In order to solve this, use parameters in the INSERT statement as you did in your stored procedure.

Sample:

// ...
mCommand.CommandText = "INSERT INTO abc (xxxx,yyyy) VALUES (@val1, @val2)";           
mCommand.Parameters.AddWithValue("@val1", dtb.Rows[0][0]);     
mCommand.Parameters.AddWithValue("@val2", dtb.Rows[0][1]);
// ...