如何将 SQL Server 过程变量设置为从 C# ASP.NET MVC 程序输入的数据？

Question

When using this code, I get an error

Procedure or function 'Registration' expects parameter '@qUsername', which was not supplied

Can someone please tell me how to fix this? This is my controller code and the SQL query for registration

public ActionResult Create([Bind(Include = "UserID,Username,FirstName,LastName,Email,Password,Number,IsAdmin,Salt")] UsersTable usersTable)
{
        if (ModelState.IsValid)
        {
            Int32 rowsAffected;
            SqlCommand cmd = new SqlCommand();
            SqlConnection sqlConnection1 = new SqlConnection(@"xxx");

            cmd.CommandText = "dbo.Registration";
            cmd.CommandType = CommandType.StoredProcedure;
            cmd.Connection = sqlConnection1;

            sqlConnection1.Open();

            rowsAffected = cmd.ExecuteNonQuery();

            sqlConnection1.Close();
            return RedirectToAction("Index");
        }

        return View(usersTable);
}

Procedure code:

CREATE PROCEDURE dbo.Registration
    @qUsername NVARCHAR(50),
    @qPassword NVARCHAR(50),
    @qFirstName NVARCHAR(40),
    @qLastName NVARCHAR(40),
    @errorResponse NVARCHAR(250) OUTPUT
AS
BEGIN
    SET NOCOUNT ON

    DECLARE @salt UNIQUEIDENTIFIER = NEWID()

    BEGIN TRY
        INSERT INTO dbo.UsersTable (UserID, Password, Salt, FirstName, LastName)
        VALUES (@qUsername, HASHBYTES('SHA2_512', @qPassword + CAST(@salt AS NVARCHAR(36))), @salt, @qFirstName, @qLastName)

        SET @errorResponse = 'Success'
    END TRY
    BEGIN CATCH
        SET @errorResponse = ERROR_MESSAGE()
    END CATCH
END

Answer 1

You need to define and set the parameters for the stored procedure before your call it from your C# code - like this:

cmd.CommandText = "dbo.Registration";
cmd.CommandType = CommandType.StoredProcedure;
cmd.Connection = sqlConnection1;

// define and set parameters!
cmd.Parameters.Add("@qUsername", SqlDbType.NVarChar, 50).Value = .....;
cmd.Parameters.Add("@qPassword", SqlDbType.NVarChar, 50).Value = .....;
cmd.Parameters.Add("@qFirstName", SqlDbType.NVarChar, 40).Value = .....;
cmd.Parameters.Add("@qLastName", SqlDbType.NVarChar, 40).Value = .....;

cmd.Parameters.Add("@errorResponse", SqlDbType.NVarChar, 250).Direction = ParameterDirection.Output;

sqlConnection1.Open();
rowsAffected = cmd.ExecuteNonQuery();
sqlConnection1.Close();

Answer 2

Use the following:

cmd.Parameters.AddWithValue("@qUsername", "xxxxx");

For all parameters before calling:

cmd.ExecuteNonQuery();