Varying number of records

Question

I am executing a SQL Server stored procedure from my C# code which essentially pulls some data from a database based on the supplied condition.

DataSet GetAllxxxxxByDate(string entityValue,string companyValue)
{
    using (var sqlConn = new SqlConnection(GetConnectionString()))
    {
        using (var cmd = new SqlCommand())
        {
            var data = new DataSet();
            cmd.CommandText = “myStoredprodecure”;
            cmd.CommandType = CommandType.StoredProcedure;
            cmd.Connection = sqlConn;

            var eVal = string.IsNullOrWhiteSpace(entityValue) ? string.Empty : entityValue;
            cmd.Parameters.AddWithValue("@entity_value", eVal);

            var company = string.IsNullOrWhiteSpace(companyValue) ? string.Empty : companyValue;
            cmd.Parameters.AddWithValue("@company", company);

            var sqlDataAdaptor = new SqlDataAdapter(cmd);
            sqlDataAdaptor.Fill(data);

            return data;
         }
     }
}

Here entityValue , companyValue are comma separated strings, formed dynamically within C# code and pass it to stored procedure.

Eg:

’first’,’second’,’third’

And the stored procedure uses these values to fill the NOT IN condition defined within it.

The issue is that, I am getting inconsistent number of records when I execute the code.

Following is a quick screenshot where first WHERE clause return 3 records and second WHERE clause return 1 record. The input values for the first WHERE clause is been filled from c# code and the second is been filled manually to test.

The only difference, which I can spot is number of quotes.

Question: can someone help me to zero in the issue or the difference in these give WHERE clause ?

Answer 1

Well, you don't show what entity_value is in your results, but the difference between the two is you're adding single quotes around the literal values:

N'''FSEC''' in SQL is the literal valiue 'FSEC'

'FSEC' in SQL is just FSEC (without the quotes).

My guess is that records 2004981 and 2004982 have a value of FSEC (without the quotes) for entity_value .

If you're adding parameter values from C# code, don't add quotes around them like you would if you were building a string. SQL will treat the values as strings without needing string qualifiers.

EDIT

Okay, I just read this statement:

Here entityValue, companyValue are comma separated string

You can't just pass in a comma-delimited string to an IN clause. To search for multiple values there are a few options:

• Add commas to each end and use LIKE:

   Where (',' + @entity_value +',' LIKE '%,' + entity_value + ',%') 

• Parse the string into a temporary table, than use that table in your IN clause

• Pass the values as a table-valued parameter and use that in your IN clause.
• Build the SQL statement as a string and execute it with EXEC