带“＃”符号附近的C＃stringbuilder错误的SQL查询

Question

I'm working on some code that creates procedures with C#. When I try to run my code:

StringBuilder sbSP1 = new StringBuilder();

sbSP1.AppendLine("CREATE PROCEDURE " + ProcN + "DELETE @id int=0 AS BEGIN DELETE FROM " + tname + " WHERE " + PK + " = @id END");

SqlConnection connection = new SqlConnection(connectionString);

using (SqlCommand cmd = new SqlCommand(sbSP1.ToString(), connection))
{
    connection.Open();
    cmd.CommandType = CommandType.Text;
    cmd.ExecuteNonQuery();
    connection.Close();
}

This part doesn't work . It throws an exception:

System.Data.SqlClient.SqlException: 'Incorrect syntax near '='.'

But when I try to run this part:

StringBuilder sbSP3 = new StringBuilder();
sbSP3.AppendLine("CREATE PROCEDURE " + ProcN + "GET AS BEGIN SET NOCOUNT ON; SELECT " + columns + " from " + tname + "  END");

SqlConnection connection = new SqlConnection(connectionString);

using (SqlCommand cmd = new SqlCommand(sbSP3.ToString(), connection))
{
    connection.Open();
    cmd.CommandType = CommandType.Text;
    cmd.ExecuteNonQuery();
    connection.Close();
}

it runs correctly.

Where is my mistake in the first snippet of code?

Answer 1

Without sbSP1 final text it's difficult to pin down the error; as a working hypothesis I suggest that PK being complex (eg "id value" ) should be escaped - [PK] . In order to avoid such kind of errors, please, never build the query, but make procedure's text being readable with a help of string interpolation - $ and verbatim strings - @ .

 //TODO: check the text, is it the procedure you want to create?
 string text = 
   $@"create procedure [{ProcN}Delete] 
        @id int = 0 as 
      begin
        delete
          from [{tname}]
         where [{PK}] = @id 
      end;"; 

 //DONE: do not close connection manually, but wrap it into using
 using (SqlConnection connection = new SqlConnection(connectionString)) {
   connection.Open();

   using (qlCommand cmd = new SqlCommand(text, connection)) {
     cmd.ExecuteNonQuery();
   }  
 }