i would like to hash a varchar and store it in db but i 've got a problem
when checking its value ,i thought i just had to hash it again and compare to db value
ALTER PROCEDURE [dbo].[AddLecteur]
#userName NVARCHAR(50),
#PasswordHash NVARCHAR(50),
#biblioPrincip int
AS
BEGIN
SET NOCOUNT ON
declare #ErrorMessage NVARCHAR(250)
declare #salt varbinary(4)=crypt_gen_random(4)
BEGIN TRY
INSERT INTO lecteur(nom, motPassword, biblioPrincipal)
VALUES(#userName,HASHBYTES('SHA2_256',cast( #PasswordHash as varbinary(max))+#salt), #biblioPrincip)
SET #ErrorMessage='Success'
END TRY
BEGIN CATCH
SET #ErrorMessage=ERROR_MESSAGE()
END CATCH
END
the value inserted is ‰¥_#碿K¤IFÕšxHà6œûäÜô4îõ„R¨Ó
am i not supposed to get the same value when checking the user if i use a salt inserted at the creation of the user and hash the user input the same way?
the second trigger hashing a proposal to compare to the one above generated when creating the user
ALTER PROCEDURE [dbo].[CheckngUser]
#userName varchar(50),
#password nvarchar(50),
#libelle varchar(50)
AS
BEGIN
declare #salt varbinary(4)
set #salt=(select lecteur.salt from lecteur where lecteur.nom=#userName)
select HASHBYTES('SHA2_256',cast( #password as varbinary(max))+#salt),
le.id,le.nom,le.[motPassword],bi.libellé from lecteur as le
inner join biblio as bi on le.biblioPrincipal=bi.id
where le.nom=#userName and le.motPassword=HASHBYTES('SHA2_256',cast(
#password as varbinary(max))+#salt)
END
why do i have this value here 0x7774FB52EB1FB5D3DD731A8B64B4BA1A73F4893F8A3C9084248D774D83C3E326
Related
I want his stored procedure to return the inserted id
ALTER PROCEDURE [dbo].[InsertAddress_DBO]
#Name VARCHAR(50)
AS
BEGIN
SET NOCOUNT ON;
INSERT INTO [dbo].[Address]([Address_Name])
OUTPUT INSERTED.Address_Id
VALUES (#Name)
END
This one the same
ALTER PROCEDURE [dbo].[InsertDocumentation_DBO]
#Texte VARCHAR(50)
AS
BEGIN
SET NOCOUNT ON;
INSERT INTO [dbo].[Documentation]([Documentation_Text])
OUTPUT inserted.Documentation_Id
VALUES (#Texte)
END
And this one to use them and return her own -
like using the inserted id to put it into the next stored procedure as a parameter
ALTER PROCEDURE [dbo].[InsertEstablishmentByStrings_DBO]
#Establishment_Name VARCHAR(50),
#Address_Name VARCHAR(50),
#Documentation_Text VARCHAR(50)
AS
BEGIN
SET NOCOUNT ON;
DECLARE #Address_ID INT ,
#Documentation_ID INT
EXEC #Address_ID = [dbo].[InsertAddress_DBO]
#Name = "rue de la banchiesserie 85 Golback"
EXEC #Documentation_ID = [dbo].[InsertDocumentation_DBO]
#Texte = "né en 55555 restaurant fabuleux"
INSERT INTO [dbo].[Establishment]([Establishment_Name],[Address_Id],[Documentation_Id])
OUTPUT inserted.Establishment_Id
VALUES (#Establishment_Name,#Address_ID,#Documentation_ID)
END
However, I always get an error, because the stored procedure doesn't return the id when I execute it.
What is wrong in my code?
I would like to get the code I could use again and again in each stored procedure I have to execute. I already tried ##Identity, indent, scoped,... nothing works.
If you want to return something from stored procedure to the context of SQL query execution you may use a return statement or an output parameter. I would suggest you to use the second option. The first one is generally intended to return status of procedure execution.
ALTER PROCEDURE [dbo].[InsertAddress_DBO]
#Name VARCHAR(50),
#Address_ID INT OUTPUT
AS
BEGIN
SET NOCOUNT ON;
INSERT INTO [dbo].[Address]([Address_Name])
VALUES (#Name)
SET #Address_ID = SCOPE_IDENTITY()
END
Than you can use returned value in your outer procedure
ALTER PROCEDURE [dbo].[InsertEstablishmentByStrings_DBO]
#Establishment_Name VARCHAR(50),
#Address_Name VARCHAR(50),
#Documentation_Text VARCHAR(50)
AS
BEGIN
SET NOCOUNT ON;
DECLARE #Address_ID INT ,
#Documentation_ID INT
EXEC [dbo].[InsertAddress_DBO]
#Address_ID = #Address_ID OUTPUT,
#Name = "rue de la banchiesserie 85 Golback"
...
END
An OUTPUT INSERTED clause you used doesn't returns data to the query execution context but send them to the output stream.
Your stored procedures should look like this, using an OUTPUT parameter, not trying to consume a RETURN value (which should never contain data) using a resultset. Also [don't] [put] [everything] [in] [square] [brackets] [unless] [you] [have] [to], [because] [all] [it] [does] [is] [hamper] [readability], and don't surround string literals with "double quotes" because that means something else in T-SQL.
CREATE OR ALTER PROCEDURE dbo.InsertAddress_DBO
#Name varchar(50),
#Address_Id int OUTPUT
AS
BEGIN
SET NOCOUNT ON;
INSERT dbo.Address(Address_Name)
VALUES (#Name);
SELECT #Address_Id = SCOPE_IDENTITY();
END
GO
CREATE OR ALTER PROCEDURE dbo.InsertDocumentation_DBO
#Texte varchar(50),
#Doc_Id int OUTPUT
AS
BEGIN
SET NOCOUNT ON;
INSERT dbo.Documentation(Documentation_Text)
VALUES (#Texte);
SELECT #Doc_Id = SCOPE_IDENTITY();
END
GO
Now, your main procedure can do this:
CREATE OR ALTER PROCEDURE dbo.InsertEstablishmentByStrings_DBO
#Establishment_Name varchar(50),
#Address_Name varchar(50),
#Documentation_Text varchar(50)
AS
BEGIN
SET NOCOUNT ON;
DECLARE #Address_ID INT ,
#Documentation_ID INT
EXEC dbo.InsertAddress_DBO
#Name = #Address_Name,
#Address_Id = #Address_ID OUTPUT;
EXEC dbo.InsertDocumentation_DBO
#Texte = Documentation_Text,
#Doc_Id = #Documentation_ID OUTPUT;
INSERT dbo.Establishment
(Establishment_Name, Address_Id, Documentation_Id)
OUTPUT inserted.Establishment_Id,
inserted.Address_ID, inserted.Documentation_ID
VALUES (#Establishment_Name,#Address_ID,#Documentation_ID);
END
GO
And you call it like this:
EXEC dbo.InsertEstablishmentByStrings_DBO
#Establishment_Name = 'Gaston''s',
#Address_Name = 'rue de la banchiesserie 85 Golback',
#Documentation_Text = 'né en 55555 restaurant fabuleux';
And get results like this:
Establishment_Id
Address_ID
Documentation_ID
1
1
1
Fully working example on db<>fiddle
I need to insert some values into a table and to do this I created a stored procedure. 4 values are passed. And two values can be inserted straight into the table, for two other values an ID needs to be found.
I have three stored procedures. When I execute the main stored procedure, I can see that the two called stored procedures are executed and come up with the correct value. However this value is not passed into the parameter.
Both parameters #uid and #did retrun 0 (zero) into the table.
What am I doing wrong??
Kind regards,
Clemens Linders
SP MES_D_GetUserID, Pass a name and you gat an ID as string
SP MES_D_GetDOrderID, Pass a name and you get an ID as integer
The main stored procedure:
USE [AddOn_DEV_HE]
GO
SET ANSI_NULLS ON
GO
SET QUOTED_IDENTIFIER ON
GO
ALTER PROCEDURE [dbo].[MES_D_Consumed]
#WERKS nvarchar(4), #USERNAME nvarchar(50), #MACHID int, #DRINKORDER nvarchar(50)
WITH EXEC AS CALLER
AS
BEGIN
SET NOCOUNT ON;
Declare #uid AS varchar(10)
Declare #did AS int
Declare #OUTUID AS varchar(10)
Declare #OUTDID AS int
exec #uid = MES_D_GetUserID #USERNAME, #OUTUID OUTPUT;
exec #did = MES_D_GetDOrderID #DRINKORDER, #OUTDID OUTPUT;
INSERT INTO Demo_D_Consumed (Werks, UserID, MachID, DrinkID, TimeDate) VALUES (#WERKS, #uid, #MACHID, #did, GETDATE());
END
and these are the two other stored procedures :
USE [AddOn_DEV_HE]
GO
SET ANSI_NULLS ON
GO
SET QUOTED_IDENTIFIER ON
GO
ALTER PROCEDURE [dbo].[MES_D_GetDOrderID]
#DRINK nvarchar(50), #OUTDID int OUTPUT
WITH EXEC AS CALLER
AS
BEGIN
SET NOCOUNT ON;
SELECT RecordNr FROM DEMO_D_ORDERS WHERE Drink = #DRINK
END
USE [AddOn_DEV_HE]
GO
SET ANSI_NULLS ON
GO
SET QUOTED_IDENTIFIER ON
GO
ALTER PROCEDURE [dbo].[MES_D_GetUserID]
#USERNAME nvarchar(50), #OUTUID nvarchar(50) OUTPUT
WITH EXEC AS CALLER
AS
BEGIN
SET NOCOUNT ON;
SELECT UserLan FROM sysUsernames WHERE UserName = #USERNAME
END
Change them to be
ALTER PROCEDURE [dbo].[MES_D_GetDOrderID]
#DRINK nvarchar(50), #OUTDID int OUTPUT
WITH EXEC AS CALLER
AS
BEGIN
SET NOCOUNT ON;
SELECT #OUTDID = RecordNr FROM DEMO_D_ORDERS WHERE Drink = #DRINK
END
And
exec MES_D_GetDOrderID #DRINKORDER, #OUTDID OUTPUT;
Your #OUTDID will have the return value. Same with the other SP.
I'm trying to insert other table's IDs (Company and Bank) into the uBankID and uCompanyID of the EndUser table and the BankID of the Company table on INSERT.
Whatever way I do this, the required fields aren't being populated, what am I doing wrong? I had a look at an inline select statement at the ID to try and grab it but couldn't fathom it and it wouldn't compile.
The variables are all present and correct in the backend and are being parsed through, all but these IDs, as nothing is going wrong with the C# I'm thinking there's something amiss with my SQL, especially as I'm fairly new to stored procedures.
Any help would be greatly appreciated.
Code (slimmed down):
CREATE PROCEDURE [ProcedureInsert]
#Title nvarchar(10),
#FirstName nvarchar(50),
#LastName nvarchar(50),
#Organisation nvarchar(50),
#Address nvarchar(50),
#uBankID int,
#uCompanyID int,
#BankID int,
#SortCode int,
#AccountNumber nvarchar(50),
#AccNameHolder nvarchar(50),
#cId int output,
#bId int output,
#euId int output
AS
BEGIN
SET NOCOUNT ON;
INSERT INTO [Bank](SortCode, AccountNumber, AccNameHolder)
VALUES(#SortCode, #AccountNumber, #AccNameHolder)
SET #bId = SCOPE_IDENTITY();
INSERT INTO [Company](Organisation, Address, BankID)
VALUES(#Organisation, #Address, #bId)
SET #cId = SCOPE_IDENTITY();
INSERT INTO [EndUser](Title, FirstName, LastName, uBankID, uCompanyID)
VALUES(#Title, #FirstName, #LastName, #uBankID, #cId)
SET #euId = SCOPE_IDENTITY();
END
You need to declare the variables. And Tab Alleman is right, get rid of the unused parameters.
DECLARE #cId int;
DECLARE #bId int;
DECLARE #euId int;
INSERT INTO [BAD](SortCode,AccountNumber,AccNameHolder)
VALUES('1234','a234','Test Name')
SET #bId=SCOPE_IDENTITY();
INSERT INTO [Company](Organisation,Address1, Address2,City,County,PostCode,Telephone,BankID)
VALUES('AnOrganisation','addressesss','Address2','City','County','PostCode','0123one', #bId)
SET #cId=SCOPE_IDENTITY();
INSERT INTO [EndUser](Title,FirstName,LastName,Email,uBankID,uCompanyID)
VALUES('Sitle','Fiame','astName','vv#Email',#bId,#cId)
SET #euId=SCOPE_IDENTITY();
EDIT
Remove those parameters if they're not being used, but they weren't in the sample code, else leave them, obviously.
Also, I used single quotes to dump in the data into the table rather than variables, if it's not working then there's something wrong with the bank end code.
How can i execute a stored procedure in another stored procedure in SQL server?
How will I pass the parameters of the second procedure.?
If you only want to perform some specific operations by your second SP and do not require values back from the SP then simply do:
Exec secondSPName #anyparams
Else, if you need values returned by your second SP inside your first one, then create a temporary table variable with equal numbers of columns and with same definition of column return by second SP. Then you can get these values in first SP as:
Insert into #tep_table
Exec secondSPName #anyparams
Update:
To pass parameter to second sp, do this:
Declare #id ID_Column_datatype
Set #id=(Select id from table_1 Where yourconditions)
Exec secondSPName #id
Update 2:
Suppose your second sp returns Id and Name where type of id is int and name is of varchar(64) type.
now, if you want to select these values in first sp then create a temporary table variable and insert values into it:
Declare #tep_table table
(
Id int,
Name varchar(64)
)
Insert into #tep_table
Exec secondSP
Select * From #tep_table
This will return you the values returned by second SP.
Hope, this clear all your doubts.
Suppose you have one stored procedure like this
First stored procedure:
Create PROCEDURE LoginId
#UserName nvarchar(200),
#Password nvarchar(200)
AS
BEGIN
DECLARE #loginID int
SELECT #loginID = LoginId
FROM UserLogin
WHERE UserName = #UserName AND Password = #Password
return #loginID
END
Now you want to call this procedure from another stored procedure like as below
Second stored procedure
Create PROCEDURE Emprecord
#UserName nvarchar(200),
#Password nvarchar(200),
#Email nvarchar(200),
#IsAdmin bit,
#EmpName nvarchar(200),
#EmpLastName nvarchar(200),
#EmpAddress nvarchar(200),
#EmpContactNo nvarchar(150),
#EmpCompanyName nvarchar(200)
AS
BEGIN
INSERT INTO UserLogin VALUES(#UserName,#Password,#Email,#IsAdmin)
DECLARE #EmpLoginid int
**exec #EmpLoginid= LoginId #UserName,#Password**
INSERT INTO tblEmployee VALUES(#EmpName,#EmpLastName,#EmpAddress,#EmpContactNo,#EmpCompanyName,#EmpLoginid)
END
As you seen above, we can call one stored procedure from another
Yes, you can do that like this:
BEGIN
DECLARE #Results TABLE (Tid INT PRIMARY KEY);
INSERT #Results
EXEC Procedure2 [parameters];
SET #total 1;
END
SELECT #total
Your sp_test: Return fullname
USE [MY_DB]
GO
IF (OBJECT_ID('[dbo].[sp_test]', 'P') IS NOT NULL)
DROP PROCEDURE [dbo].sp_test;
GO
CREATE PROCEDURE [dbo].sp_test
#name VARCHAR(20),
#last_name VARCHAR(30),
#full_name VARCHAR(50) OUTPUT
AS
SET #full_name = #name + #last_name;
GO
In your sp_main
...
DECLARE #my_name VARCHAR(20);
DECLARE #my_last_name VARCHAR(30);
DECLARE #my_full_name VARCHAR(50);
...
EXEC sp_test #my_name, #my_last_name, #my_full_name OUTPUT;
...
You can call User-defined Functions in a stored procedure alternately
this may solve your problem to call stored procedure
Yes ,
Its easy to way we call the function inside the store procedure.
for e.g. create user define Age function and use in select query.
select dbo.GetRegAge(R.DateOfBirth, r.RegistrationDate) as Age,R.DateOfBirth,r.RegistrationDate from T_Registration R
Procedure example:
Create PROCEDURE SP_Name
#UserName nvarchar(200),
#Password nvarchar(200)
AS
BEGIN
DECLARE #loginID int
--Statements for this Store Proc
--
--
--
--execute second store procedure
--below line calling sencond Store Procedure Exec is used for execute Store Procedure.
**Exec SP_Name_2 #params** (if any)
END
This stored procedure doesn't work. It just returns 0 rows. I've checked the SQL and it returns the correct value when parsed directly to the DB. What could be wrong?
ALTER PROCEDURE dbo.GetSaltOfUser
(
#eMail nvarchar
)
AS
DECLARE #result nvarchar
/* SET NOCOUNT ON */
BEGIN
SELECT #result = salt
FROM UserSet
WHERE eMail = #eMail
RETURN #result
END
#eMail nvarchar
Will truncate the passed in email to one character. You need to put in a length. e.g.
#eMail nvarchar(50)
This should match the datatype of the relevant column in UserSet
Also do you really want to be using the return code for this or do you want to use an output parameter perhaps - or just a scalar select?
ALTER PROCEDURE dbo.GetSaltOfUser
(
#eMail nvarchar (50), /*Should match datatype of UserSet.eMail*/
#salt nvarchar (50) OUTPUT /*Should match datatype of UserSet.salt*/
)
AS
BEGIN
SET NOCOUNT ON
SELECT #result = salt
FROM UserSet
WHERE eMail = #eMail
END
And to call it
DECLARE #salt nvarchar(50)
EXECUTE dbo.GetSaltOfUser N'abc#example.com', #salt OUTPUT
SELECT #salt
You do not need to assign the salt to a variable.
CREATE PROCEDURE dbo.GetSaltOfUser
(
#eMail nvarchar
)
AS
BEGIN
SELECT salt
FROM UserSet
WHERE eMail = #eMail
END
Two Cents from my end
Good you are using SET NOCOUNT ON
Always use RETURN to return status code, Example 0- success, 1 - failure
Use SELECT to return the ROWS
Use Try Catch to handle Error Conditions