Pass date parameter to dynamic sql - sql

Question

I'm having a very hard time framing this query. The error is - Conversion failed when converting date from character string.
It is a generic query to work for all tables. All was working good, but i had to add a date parameter.
SQL:
DECLARE #qryUpd nvarchar(MAX), #params nvarchar(MAX), #TableName nvarchar(50),
#ColName nvarchar(50),#Id nvarchar(50),#ModifiedBy nvarchar(50),
#ModifiedDate datetime
set #qry = 'update '+#TableName+' set Deleted=1, ModifiedBy='+''''+#Id+''',
ModifiedDate='+''''+#ModifiedDate+''''+' where '+#Colname+'='+''''+
#Id+''''
execute sp_executesql #qry
C#:
public void test(int id, int userid)
{
sqlCommand cmd = new sqlcommand("TestFunc",con);
cmd.commandtype = commandtype.storedprocedure;
cmd.parameters.addwithvalue("#TableName","tblArea");
cmd.parameters.addwithvalue("#ColName","AreaId");
cmd.parameters.addwithvalue("#Id",id);
cmd.parameters.addwithvalue("#ModifiedBy",userid);
cmd.parameters.addwithvalue("#ModifiedDate",system.datetime.now.tostring());
}

Answer 1

With the exception of the dynamic table name and the column, you can at least partially parameterize your query, which will take away the headache of escaping quotes, and also give some protection against Sql Injection (since the table and column are still vulnerable and need to be validated):
DECLARE #qry AS NVARCHAR(MAX);
set #qry = N'update '+#TableName +
' set Deleted=1, ModifiedBy=#ModifiedBy, ModifiedDate=#ModifiedDate
where ' + #Colname + ' = #Id';
exec sp_executesql #qry,
N'#Id nvarchar(50), #ModifiedBy nvarchar(50), #ModifiedDate datetime',
#Id = #Id,
#ModifiedBy = #ModifiedBy,
#ModifiedDate = #ModifiedDate;
SqlFiddle here
You can then bind your .Net parameters for #Id, #ModifiedBy and #ModifiedDate directly with the native types

Answer 2

You are passing the parameters in the wrong way. Use this:
DECLARE #ParmDefinition nvarchar(500);
set #ParmDefinition = '#Id int, #ModifiedDate datetime'
set #qry = 'update '+#TableName+' set Deleted=1, ModifiedBy=#Id, ModifiedDate=#ModifiedDate where ' + #Colname + '=#Id'
execute sp_executesql #qry, #ParmDefinition, #ModifiedDate, #Id
Also pass parameter as DateTime instead of string by removing the ToString

Answer 3

The column ModifiedDate is a datetime field then you must pass the value as a a datetime not as a string
cmd.parameters.addwithvalue("#ModifiedDate",DateTime.Now);

Answer 4

Try to change your last C# row:
cmd.parameters.addwithvalue("#ModifiedDate",system.datetime.now.tostring());
with this:
cmd.Parameters.AddWithValue("#ModifiedDate",System.Datetime.Now.ToString("yyyyMMdd", System.Globalization.CultureInfo.InvariantCulture);