尝试执行存储过程时发生意外错误

Question

I get the following exception when i try to execute specific stored procedure :

 Input string was in incorrect format 

---

my .cs :

 sQuery.Append("EXECUTE procedure get_department(" + dep_code + "," + emp_code + "," + batch_code + ")");
 return DAL_Helper.Return_DataTable(sQuery.ToString());

---

I debug and make sure all the parameters are intger .

   public DataTable Return_DataTable(string cmdText)
    {
        Open_Connection();
        DataTable dt = new DataTable();
        command.CommandText = cmdText;
        command.CommandType = CommandType.Text;
        command.Connection = connection;
        try
        {
            dt.Load(command.ExecuteReader());
        }
        catch (IfxException ifxEx)// Handle IBM.data.informix : mostly catched
        {
            ErrMapping.WriteLog("\r\n Error Code: " + ifxEx.Errors[0].NativeError.ToString() +
                                "\r\n MEssage: " + ifxEx.Errors[0].Message);
            throw new Exception("ERROR:" + ifxEx.Errors[0].NativeError.ToString() +
                                "\r\n MEssage: " + ifxEx.Errors[0].Message);
        }
        catch (Exception ex)// Handle all other exceptions.
        {
            ErrMapping.WriteLog("\r\n Error Message: " + ex.Message);
            throw new Exception("\r\n Error Message: " + ex.Message);
        }
        finally
        {
            Close_Connection();
        }
        return dt;
    }

---

EDIT 1 :

public DataTable Return_DataTable(string cmdText, CommandType cmdType, Dictionary<string, string> Param_arr)
        {
            Open_Connection();
            int return_val = -1;
            DataTable dt = new DataTable();
            command.CommandText = cmdText;
            command.CommandType = cmdType;
            if (cmdType == CommandType.StoredProcedure)
            {
                if (Param_arr != null)
                {
                    command.Parameters.Clear();
                    if (Param_arr.Count > 0)
                    {
                        for (IEnumerator<KeyValuePair<string, string>> enumerator = Param_arr.GetEnumerator(); enumerator.MoveNext(); )
                        {
                            param = command.CreateParameter();
                            param.ParameterName = enumerator.Current.Key.ToString();
                            param.Value = enumerator.Current.Value.ToString();
                            command.Parameters.Add(param);
                        }
                    }
                }
            }
            IfxDataReader dr2;
            try
            {
                dr2 = command.ExecuteReader();
                dt.Load(dr2);
            }
            catch (IfxException ifxEx)// Handle IBM.data.informix : mostly catched
            {
                ErrMappingForInformix.WriteLog("\r\n Error Code: " + ifxEx.Errors[0].NativeError.ToString() +
                                    "\r\n MEssage: " + ifxEx.Errors[0].Message);
                throw new Exception("ERROR:" + ifxEx.Errors[0].NativeError.ToString() +
                                    "\r\n MEssage: " + ifxEx.Errors[0].Message);
            }
            catch (Exception ex)// Handle all other exceptions.
            {
                ErrMappingForInformix.WriteLog("\r\n Error Message: " + ex.Message);
                throw new Exception("\r\n Error Message: " + ex.Message);
            }
            finally
            {
                Close_Connection();
            }
            return dt;
        }

Answer 1

How about this:

command.CommandText = "get_department";
command.CommandType = CommandType.StoredProcedure;
cmd.Parameters.Add(new SqlParameter("dep_code", dep_code));
cmd.Parameters.Add(new SqlParameter("emp_code", emp_code));
cmd.Parameters.Add(new SqlParameter("batch_code", batch_code));

Take a look at the different examples in this article (and more specifically: Listing 4. Executing a stored procedure with a parameter ).

The following line of code:

sQuery.Append("EXECUTE procedure get_department(" + dep_code + "," + emp_code + "," + batch_code + ")");

is like a desperate attempt to break everything and vulnerable to SQL injection. Never use string concatenations when building your SQL queries.

Answer 2

AS I know you don't need to write 'procedure' and brackets:

"EXECUTE get_department" + dep_code + "," + emp_code + "," + batch_code

http://msdn.microsoft.com/en-us/library/ms188332.aspx