Question

My stored procedure is called as below from an SQL instegartion package within SQL Server 2005

EXEC ? = Validation.PopulateFaultsFileDetails ? , 0

Though i’m not sure what the ? means

Answer 1

When this SQL statment is called, both question marks (?) will be replaced. The first will be replaced by a variable which will receive the return value of the stored procedure. The second will be replaced by a value which will be passed into the stored procedure. The code to use this statement will look something like this (pseudocode):

dim result SQL = 'EXEC ? = Validation.PopulateFaultsFileDetails ? , 0' SQL.execute(result, 99)    // pass in 99 to the stored proc debug.print result 

This gives you 3 advantages:

1. you can re-use the same bit of SQL with different values
2. you can pick up the return value and test for success/error
3. if the value you are passing in is a string, it should be correctly escaped for you, reducing the risk of SQL injection vulnerabilities in your app.