I want to have some information available for any stored procedure, such as current user. Following the temporary table method indicated here, I have tried the following:
1) create temporary table when connection is opened
private void setConnectionContextInfo(SqlConnection connection)
{
if (!AllowInsertConnectionContextInfo)
return;
var username = HttpContext.Current?.User?.Identity?.Name ?? "";
var commandBuilder = new StringBuilder($#"
CREATE TABLE #ConnectionContextInfo(
AttributeName VARCHAR(64) PRIMARY KEY,
AttributeValue VARCHAR(1024)
);
INSERT INTO #ConnectionContextInfo VALUES('Username', #Username);
");
using (var command = connection.CreateCommand())
{
command.Parameters.AddWithValue("Username", username);
command.ExecuteNonQuery();
}
}
/// <summary>
/// checks if current connection exists / is closed and creates / opens it if necessary
/// also takes care of the special authentication required by V3 by building a windows impersonation context
/// </summary>
public override void EnsureConnection()
{
try
{
lock (connectionLock)
{
if (Connection == null)
{
Connection = new SqlConnection(ConnectionString);
Connection.Open();
setConnectionContextInfo(Connection);
}
if (Connection.State == ConnectionState.Closed)
{
Connection.Open();
setConnectionContextInfo(Connection);
}
}
}
catch (Exception ex)
{
if (Connection != null && Connection.State != ConnectionState.Open)
Connection.Close();
throw new ApplicationException("Could not open SQL Server Connection.", ex);
}
}
2) Tested with a procedure which is used to populate a DataTable using SqlDataAdapter.Fill, by using the following function:
public DataTable GetDataTable(String proc, Dictionary<String, object> parameters, CommandType commandType)
{
EnsureConnection();
using (var command = Connection.CreateCommand())
{
if (Transaction != null)
command.Transaction = Transaction;
SqlDataAdapter adapter = new SqlDataAdapter(proc, Connection);
adapter.SelectCommand.CommandTimeout = CommonConstants.DataAccess.DefaultCommandTimeout;
adapter.SelectCommand.CommandType = commandType;
if (Transaction != null)
adapter.SelectCommand.Transaction = Transaction;
ConstructCommandParameters(adapter.SelectCommand, parameters);
DataTable dt = new DataTable();
try
{
adapter.Fill(dt);
return dt;
}
catch (SqlException ex)
{
var err = String.Format("Error executing stored procedure '{0}' - {1}.", proc, ex.Message);
throw new TptDataAccessException(err, ex);
}
}
}
3) called procedure tries to get the username like this:
DECLARE #username VARCHAR(128) = (select AttributeValue FROM #ConnectionContextInfo where AttributeName = 'Username')
but #ConnectionContextInfo is no longer available in the context.
I have put a SQL profiler against the database, to check what is happening:
temporary table is created successfully using a certain SPID
procedure is called using the same SPID
Why is temporary table not available within the procedure scope?
In T-SQL doing the following works:
create a temporary table
call a procedure that needs data from that particular temporary table
temporary table is dropped only explicitly or after current scope ends
Thanks.
As was shown in this answer, ExecuteNonQuery uses sp_executesql when CommandType is CommandType.Text and command has parameters.
The C# code in this question doesn't set the CommandType explicitly and it is Text by default, so most likely end result of the code is that CREATE TABLE #ConnectionContextInfo is wrapped into sp_executesql. You can verify it in the SQL Profiler.
It is well-known that sp_executesql is running in its own scope (essentially it is a nested stored procedure). Search for "sp_executesql temp table". Here is one example: Execute sp_executeSql for select...into #table but Can't Select out Temp Table Data
So, a temp table #ConnectionContextInfo is created in the nested scope of sp_executesql and is automatically deleted as soon as sp_executesql returns.
The following query that is run by adapter.Fill doesn't see this temp table.
What to do?
Make sure that CREATE TABLE #ConnectionContextInfo statement is not wrapped into sp_executesql.
In your case you can try to split a single batch that contains both CREATE TABLE #ConnectionContextInfo and INSERT INTO #ConnectionContextInfo into two batches. The first batch/query would contain only CREATE TABLE statement without any parameters. The second batch/query would contain INSERT INTO statement with parameter(s).
I'm not sure it would help, but worth a try.
If that doesn't work you can build one T-SQL batch that creates a temp table, inserts data into it and calls your stored procedure. All in one SqlCommand, all in one batch. This whole SQL will be wrapped in sp_executesql, but it would not matter, because the scope in which temp table is created will be the same scope in which stored procedure is called. Technically it will work, but I wouldn't recommend following this path.
Here is not an answer to the question, but suggestion to solve the problem.
To be honest, the whole approach looks strange. If you want to pass some data into the stored procedure why not use parameters of this stored procedure. This is what they are for - to pass data into the procedure. There is no real need to use temp table for that. You can use a table-valued parameter (T-SQL, .NET) if the data that you are passing is complex. It is definitely an overkill if it is simply a Username.
Your stored procedure needs to be aware of the temp table, it needs to know its name and structure, so I don't understand what's the problem with having an explicit table-valued parameter instead. Even the code of your procedure would not change much. You'd use #ConnectionContextInfo instead of #ConnectionContextInfo.
Using temp tables for what you described makes sense to me only if you are using SQL Server 2005 or earlier, which doesn't have table-valued parameters. They were added in SQL Server 2008.
MINOR ISSUE: I am going to assume for the moment that the code posted in the Question isn't the full piece of code that is running. Not only are there variables used that we don't see getting declared (e.g. AllowInsertConnectionContextInfo), but there is a glaring omission in the setConnectionContextInfo method: the command object is created but never is its CommandText property set to commandBuilder.ToString(), hence it appears to be an empty SQL batch. I'm sure that this is actually being handled correctly since 1) I believe submitting an empty batch will generate an exception, and 2) the question does mention that the temp table creation appears in the SQL Profiler output. Still, I am pointing this out as it implies that there could be additional code that is relevant to the observed behavior that is not shown in the question, making it more difficult to give a precise answer.
THAT BEING SAID, as mentioned in #Vladimir's fine answer, due to the query running in a sub-process (i.e. sp_executesql), local temporary objects -- tables and stored procedures -- do not survive the completion of that sub-process and hence are not available in the parent context.
Global temporary objects and permanent/non-temporary objects will survive the completion of the sub-process, but both of those options, in their typical usage, introduce concurrency issues: you would need to test for the existence first before attempting to create the table, and you would need a way to distinguish one process from another. So these are not really a great option, at least not in their typical usage (more on that later).
Assuming that you cannot pass in any values into the Stored Procedure (else you could simply pass in the username as #Vladimir suggested in his answer), you have a few options:
The easiest solution, given the current code, would be to separate the creation of the local temporary table from the INSERT command (also mentioned in #Vladimir's answer). As previously mentioned, the issue you are encountering is due to the query running within sp_executesql. And the reason sp_executesql is being used is to handle the parameter #Username. So, the fix could be as simple as changing the current code to be the following:
string _Command = #"
CREATE TABLE #ConnectionContextInfo(
AttributeName VARCHAR(64) PRIMARY KEY,
AttributeValue VARCHAR(1024)
);";
using (var command = connection.CreateCommand())
{
command.CommandText = _Command;
command.ExecuteNonQuery();
}
_Command = #"
INSERT INTO #ConnectionContextInfo VALUES ('Username', #Username);
");
using (var command = connection.CreateCommand())
{
command.CommandText = _Command;
// do not use AddWithValue()!
SqlParameter _UserName = new SqlParameter("#Username", SqlDbType.NVarChar, 128);
_UserName.Value = username;
command.Parameters.Add(_UserName);
command.ExecuteNonQuery();
}
Please note that temporary objects -- local and global -- cannot be accessed in T-SQL User-Defined Functions or Table-Valued Functions.
A better solution (most likely) would be to use CONTEXT_INFO, which is essentially session memory. It is a VARBINARY(128) value but changes to it survive any sub-process since it is not an object. Not only does this remove the current complication you are facing, but it also reduces tempdb I/O considering that you are creating and dropping a temporary table each time this process runs, and doing an INSERT, and all 3 of those operations are written to disk twice: first in the Transaction Log, then in the data file. You can use this in the following manner:
string _Command = #"
DECLARE #User VARBINARY(128) = CONVERT(VARBINARY(128), #Username);
SET CONTEXT_INFO #User;
";
using (var command = connection.CreateCommand())
{
command.CommandText = _Command;
// do not use AddWithValue()!
SqlParameter _UserName = new SqlParameter("#Username", SqlDbType.NVarChar, 128);
_UserName.Value = username;
command.Parameters.Add(_UserName);
command.ExecuteNonQuery();
}
And then you get the value within the Stored Procedure / User-Defined Function / Table-Valued Function / Trigger via:
DECLARE #Username NVARCHAR(128) = CONVERT(NVARCHAR(128), CONTEXT_INFO());
That works just fine for a single value, but if you need multiple values, or if you are already using CONTEXT_INFO for another purpose, then you either need to go back to one of the other methods described here, OR, if using SQL Server 2016 (or newer), you can use SESSION_CONTEXT, which is similar to CONTEXT_INFO but is a HashTable / Key-Value pairs.
Another benefit of this approach is that CONTEXT_INFO (at least, I haven't yet tried SESSION_CONTEXT) is available in T-SQL User-Defined Functions and Table-Valued Functions.
Finally, another option would be to create a global temporary table. As mentioned above, global objects have the benefit of surviving sub-processes, but they also have the drawback of complicating concurrency. A seldom-used to get the benefit without the drawback is to give the temporary object a unique, session-based name, rather than add a column to hold a unique, session-based value. Using a name that is unique to the session removes any concurrency issues while allowing you to use an object that will get automatically cleaned up when the connection is closed (so no need to worry about a process that creates a global temporary table and then runs into an error before completing, whereas using a permanent table would require cleanup, or at least an existence check at the beginning).
Keeping in mind the restriction that we cannot pass any value into the Stored Procedure, we need to use a value that already exists at the data layer. The value to use would be the session_id / SPID. Of course, this value does not exist in the app layer, so it has to be retreived, but there was no restriction placed on going in that direction.
int _SessionId;
using (var command = connection.CreateCommand())
{
command.CommandText = #"SET #SessionID = ##SPID;";
SqlParameter _paramSessionID = new SqlParameter("#SessionID", SqlDbType.Int);
_paramSessionID.Direction = ParameterDirection.Output;
command.Parameters.Add(_UserName);
command.ExecuteNonQuery();
_SessionId = (int)_paramSessionID.Value;
}
string _Command = String.Format(#"
CREATE TABLE ##ConnectionContextInfo_{0}(
AttributeName VARCHAR(64) PRIMARY KEY,
AttributeValue VARCHAR(1024)
);
INSERT INTO ##ConnectionContextInfo_{0} VALUES('Username', #Username);", _SessionId);
using (var command = connection.CreateCommand())
{
command.CommandText = _Command;
SqlParameter _UserName = new SqlParameter("#Username", SqlDbType.NVarChar, 128);
_UserName.Value = username;
command.Parameters.Add(_UserName);
command.ExecuteNonQuery();
}
And then you get the value within the Stored Procedure / Trigger via:
DECLARE #Username NVARCHAR(128),
#UsernameQuery NVARCHAR(4000);
SET #UsernameQuery = CONCAT(N'SELECT #tmpUserName = [AttributeValue]
FROM ##ConnectionContextInfo_', ##SPID, N' WHERE [AttributeName] = ''Username'';');
EXEC sp_executesql
#UsernameQuery,
N'#tmpUserName NVARCHAR(128) OUTPUT',
#Username OUTPUT;
Please note that temporary objects -- local and global -- cannot be accessed in T-SQL User-Defined Functions or Table-Valued Functions.
Finally, it is possible to use a real / permanent (i.e. non-temporary) Table, provided that you include a column to hold a value specific to the current session. This additional column will allow for concurrent operations to work properly.
You can create the table in tempdb (yes, you can use tempdb as a regular DB, doesn't need to be only temporary objects starting with # or ##). The advantages of using tempdb is that the table is out of the way of everything else (it is just temporary values, after all, and doesn't need to be restored, so tempdb using SIMPLE recovery model is perfect), and it gets cleaned up when the Instance restarts (FYI: tempdb is created brand new as a copy of model each time SQL Server starts).
Just like with Option #3 above, we can again use the session_id / SPID value since it is common to all operations on this Connection (as long as the Connection remains open). But, unlike Option #3, the app code doesn't need the SPID value: it can be inserted automatically into each row using a Default Constraint. This simplies the operation a little.
The concept here is to first check to see if the permanent table in tempdb exists. If it does, then make sure that there is no entry already in the table for the current SPID. If it doesn't, then create the table. Since it is a permanent table, it will continue to exist, even after the current process closes its Connection. Finally, insert the #Username parameter, and the SPID value will populate automatically.
// assume _Connection is already open
using (SqlCommand _Command = _Connection.CreateCommand())
{
_Command.CommandText = #"
IF (OBJECT_ID(N'tempdb.dbo.Usernames') IS NOT NULL)
BEGIN
IF (EXISTS(SELECT *
FROM [tempdb].[dbo].[Usernames]
WHERE [SessionID] = ##SPID
))
BEGIN
DELETE FROM [tempdb].[dbo].[Usernames]
WHERE [SessionID] = ##SPID;
END;
END;
ELSE
BEGIN
CREATE TABLE [tempdb].[dbo].[Usernames]
(
[SessionID] INT NOT NULL
CONSTRAINT [PK_Usernames] PRIMARY KEY
CONSTRAINT [DF_Usernames_SessionID] DEFAULT (##SPID),
[Username] NVARCHAR(128) NULL,
[InsertTime] DATETIME NOT NULL
CONSTRAINT [DF_Usernames_InsertTime] DEFAULT (GETDATE())
);
END;
INSERT INTO [tempdb].[dbo].[Usernames] ([Username]) VALUES (#UserName);
";
SqlParameter _UserName = new SqlParameter("#Username", SqlDbType.NVarChar, 128);
_UserName.Value = username;
command.Parameters.Add(_UserName);
_Command.ExecuteNonQuery();
}
And then you get the value within the Stored Procedure / User-Defined Function / Table-Valued Function / Trigger via:
SELECT [Username]
FROM [tempdb].[dbo].[Usernames]
WHERE [SessionID] = ##SPID;
Another benefit of this approach is that permanent tables are accessible in T-SQL User-Defined Functions and Table-Valued Functions.
"There are two types of temporary tables: local and global. They differ from each other in their names, their visibility, and their availability. Local temporary tables have a single number sign (#) as the first character of their names; they are visible only to the current connection for the user, and they are deleted when the user disconnects from the instance of SQL Server. Global temporary tables have two number signs (##) as the first characters of their names; they are visible to any user after they are created, and they are deleted when all users referencing the table disconnect from the instance of SQL Server." -- from here
so the answer to your problem is put ## instead of # to make the local temporary table to global.
I would like to run a script like:
CREATE LOGIN [me] WITH PASSWORD = #0
and run it like:
var createUserCommand = conn.CreateCommand();
createUserCommand.CommandText = script;
createUserCommand.Parameters.AddWithValue("#0", passwordDecrypted);
However, this throws:
A first chance exception of type 'System.Data.SqlClient.SqlException' occurred in System.Data.dll
Additional information: Incorrect syntax near '#0'.
From what I read online (nowhere official, just from SO answers/comments) it is not possible to use SQL parameters with DDL statements. Link to official docs for this are welcome!
OK. I do need this parametrized. As I see it, there are 2 options:
I manually sanitize (.Replace("'", "''") => how can I do this best?
I call into .NET to sanitize for me. However I assume this is not sanitized within ADO.NET, but just past to SQL Server, and sanitized there...
What would be the best approach?
All you need to escape is the single ' to 2 x '
commandText = string.Format("CREATE LOGIN [me] WITH PASSWORD = '{0}'", pass.Replace("'", "''"));
An alternative would be to create a stored procedure with a password parameter and use it to build a CREATE LOGIN string which you then sp_executeSQL.
The error:
Procedure or Function '' expects parameter '#Param1' which was not supplied.
An excerpt of the stored procedure:
I have a stored procedure on a SQL Server 2012. The procedure looks something like this...
SELECT *
FROM Orders
WHERE Orders.CustomerID = #param1 AND
Orders.CustomerJoinDate = #param2
I call it from my code {Using Visual Studio 2008} like so...
The calling method in Visual Studios:
First I create an array of parameters I'm going to pass...
Dim Param() As SqlClient.SqlParameter =
New SqlClient.SqlParameter()
{
New SqlClient.SqlParameter("#Param1", Me.cmbFilter1.Text),
New SqlClient.SqlParameter("#Param2", Me.cmbFilter2.Text)
}
Then I loop through the parameters and add them to a command to be executed by a datareader.
The mSQLCmd is set to call the stored procedure described above...
mSQLCmd.Parameters.Clear()
mSQLCmd.CommandText = SQLCmd
For Each sParam As SqlClient.SqlParameter In Param
mSQLCmd.Parameters.AddWithValue(sParam.ParameterName, sParam.Value)
Next
Error occurs when:
I try to run mSQL.ExecuteReader() Can someone point me in the right direction on this? I've verified that each parameter is included in the Param() with the correct values.
I've also tested the stored procedure on SQL Server and verified when the two necessary parameters are provided it works correctly. Something is wrong on the vb side.
If you're calling a stored procedure, you need to set the CommandType of the SqlCommand accordingly!
mSQLCmd.CommandText = SQLCmd
// add this line!
mSQLCmd.CommandType = CommandType.StoredProcedure
Otherwise the name of the stored procedure you're trying to call is interpreted as a SQL command you're trying to execute.
I am writing a F# to be used with Azure Worker role. I want the class to have the connection string a as a parameter. I create a db connection with
type dbSchema = SqlDataConnection<"...">
let db = dbSchema.GetDataContext()
but dbSchema is a type so it cannot be embeded in my class (another type). I can create two separate modules, one with the db connection and another one with my class
module DataSource =
[<Literal>]
let connectionString = "Data Source=.\SQLEXPRESS;Initial Catalog=Service;Integrated Security=True"
type dbSchema = SqlDataConnection<connectionString>
let db = dbSchema.GetDataContext()
module DealerFactory =
type Factory(connectionString) =
member this.GetList(latitudeLeftTop, longitudeLeftTop, latitudeRightBottom, longitudeRightBottom) =
".."
But how do I use the connectionString in my class' constructor to create the connection?
The type provider for SQL database uses connection string for two different purposes. First, it needs one (at compile time) to generate the database schema. Second, you may (optionally) give it another one to use at runtime when actually running the program.
The compile-time connection string needs to be specified as parameter in SqlDataConnection<...> and the run-time connection string can be passed to GetDataContext(...) operation.
So, you can define your type using statically known compile-time connection string:
[<Literal>]
let connectionString = "Data Source=.\SQLEXPRESS;Initial Catalog=Service; ..."
type dbSchema = SqlDataConnection<connectionString>
And when you want to create an instance of the DB connection, you can pass it another connection string:
type Factory(connectionString) =
// Create connection to the DB using (a different)
// connection string specified at runtime
let db = dbSchema.GetDataContext(connectionString)
member this.GetList( latitudeLeftTop, longitudeLeftTop,
latitudeRightBottom, longitudeRightBottom) =
// Use local 'db' to access the database
query { for v db.Table do select v }
Compared with your original code (with the db value in a module), there is a difference that this creates a new db instance for every Factory, but I guess this is expected if Factory takes the connection string as an argument.
I am new to dbexpress and I cannot figure out how to set the TSQLConnection parm for the SQL Host name at runtime. When I install my program on a client system the TSQLConnectionHost is still reading the Host from my development system that I entered during development.
TSQLConnection.Params is of type TStrings, which means it holds a set of String items. In case of TSQLConnection, Params holds a set of Name=Value pairs, where Name is a parameter name and Value is that parameters value. To read a value of specific parameter, use:
var
s: String;
...
s := SQLConnection1.Params.Values['ParamName'];
To assign a value to specific parameter, use:
SQLConnection1.Params.Values['ParamName'] := 'NewValue';
(Substitute 'ParamName' with actual parameter name and 'NewValue' with actual new value.)
I faced this problem a few years ago when I started developing with dbExpress. On my development machine, the databases were in location X whereas the production machines had the databases in location Y. The way I got around this was to store the physical location of the database in the registry (via a small utility program which I wrote) and then use the following code to load the correct value. The location could be stored in an INI file which would require a slight alteration to my code, but that part is less important.
procedure TDm.SQLConnection1BeforeConnect(Sender: TObject);
var
dir: string;
begin
with TRegIniFile.create (regpath) do // this is where I get the physical value
begin
dir:= ReadString ('firebird', progname, '');
free
end;
with sqlconnection1 do
begin
close;
params.values['database']:= dir;
end;
end;
The reason for your problem is that you have not disconnected the SQLConnection AND all datasets before distrbuting your app.
Things to do
a) make sure all components are NOT connected.
b) set the params of the SQLConnection to blanks.
c) when you app starts, read the required connection params from an ini file, and populate the SQLConnection with those.
d) THEN connect and you will be fine!
Regards
Chris