Question

I have this stored procedure and when I call from my c# code, I get the error and I don’t know what is the problem.

Stored procedure

ALTER procedure [dbo].[modProducto]    

Store Procedure    
@id integer,    
@descripcion varchar(100),    
@tipoproducto integer,  
@existencia integer,  
@precio money  
AS  
 update producto  
set descripcion = @descripcion, idtipoproducto = @tipoproducto, existencia = @existencia, precio = @precio  
where idproducto = @id  
select 'Producto modificado correctamente'  

C# Code

MessageBox.Show(cx.ejecutarOtro("modProducto " +    
                                txtProducto.Text + ",'" +  
                                txtDescripcion.Text + "'," +  
                                (comboProducto.SelectedIndex + 1) + "," +  
                                numericUpDownExistencia.Text + "," +  
                                txtPrecioProducto.Text  
                               ));  

• cx.ejecutarotro is an method that execute the SQL query.
• txtProducto, txtDescripcion and txtPrecioProducto are textboxes.
• Numericupdownexistencia is a NumericUpDown box.
• comboProducto is a dropdown list.

Thanks in advance.

Answer 1

The problem is probably i18n formatting of numbers – commas vs periods. The answer is: parse the inputs properly, and use parameters. Never. Never. Never concatenate user input into SQL. Did I mention never?