stored proc values

[texas]

what do i need to put after this: strStoredProc = "EXEC p_test_data_entry @claim1 = '" & Me.txt_claim.Text & "'"


so i can get the values of the remaining values?

        strStoredProc = "EXEC p_test_data_entry @claim1 = '" & Me.txt_claim.Text & "'" '@refund = '" & Me.DropDownList_refund_type.SelectedItem.Text & "' @reason = '" & Me.DropDownList_reason_overpay.SelectedItem.Text & "'"

    Private Sub btn_save_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles btn_save.Click

        Dim strStoredProc As String
        Dim myConnection As New SqlConnection("data source=AUS-REPORTING;initial catalog=Log;user id=user;password=password")
        Dim x As String

        strStoredProc = "EXEC p_test_data_entry @claim1 = '" & Me.txt_claim.Text & "'" '@refund = '" & Me.DropDownList_refund_type.SelectedItem.Text & "' @reason = '" & Me.DropDownList_reason_overpay.SelectedItem.Text & "'"

        Dim sqlCmd As New SqlClient.SqlCommand(strStoredProc, myConnection)

        'Try
        myConnection.Open()

        sqlCmd.ExecuteNonQuery()

        myConnection.Close()
        'Catch
        '    myConnection.Close()
        'End Try



    End Sub

[hellswraith]

I don't understand what you are asking. Post your stored procedure, and I will try to figure out what you are doing wrong.

[texas]

i'm not sure how to write the string to pass the values to the stored proc.

values for @claim1,@refund,@reason



strStoredProc = "EXEC p_test_data_entry @claim1 = '" &
Me.txt_claim.Text & "'" '@refund = '" &
Me.DropDownList_refund_type.SelectedItem.Text & "' @reason
= '" & Me.DropDownList_reason_overpay.SelectedItem.Text & "'"

[hellswraith]

Private Sub btn_save_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles btn_save.Click

Dim strStoredProc As String
Dim myConnection As New SqlConnection("data source=AUS-REPORTING;initial catalog=Log;user id=user;password=password")
Dim x As String


strStoredProc = "p_test_data_entry"

Dim sqlCmd As New SqlClient.SqlCommand(strStoredProc, myConnection)
sqlCmd.CommandType = CommandType.StoredProcedure
sqlCmd.Parameters.Add("@claim1", Me.txt_claim.Text)
'Repeat for each parameter.

'Try
myConnection.Open()

sqlCmd.ExecuteNonQuery()

myConnection.Close()
'Catch
' myConnection.Close()
'End Try



End Sub

[texas]

i got it


strStoredProc = "EXEC p_test_data_entry @claim1 = '" & Me.txt_claim.Text & "', @refund = '" & Me.DropDownList_refund_type.SelectedItem.Text & "', @reason = '" & Me.DropDownList_reason_overpay.SelectedItem.Text & "'"



hell.... thanks for help.

[hellswraith]

Ok, but building a string like you are doing is hard to debug and find errors, as you have noticed.

Using the built in parameters collection of the command object will simplify development, make it easier to debug, etc. You might want to give serious thought on how you are doing it compared to the other ways.

Also, look at the data application block from MS Just do a search for it on google to find it.

[pvb]

Ya, also might leave yourself open for a sql injection attack.
Let's say you have a table like this:

create table TexasTable ( UserName varchar(10) not null ) 

and a stored proc like this

create proc TexasProc @UserName varchar ( 50 ) as
-- do nothing 

Now lets say you have some code to build the sql like this:

sqlText = "Exec TexasProc @UserName='" & Me.txtUserName.Text & "'"

Some bored kid, trying all weekend long, might finally try sending in the value '';Drop Table TexasTable;select '' for the Me.txtUserName.Text field. Unless you're checking the values that are being entered in those fields or are using a read only type of account, bye bye table. Try it out, I didn't believe it until I tried it out at home using basically the same code as above. Using the xxxCommand object and xxxParameters collections like hellswraith suggested protect against alot of this kind of code.