EXECUTE A STORED PROCEDURE IN A SQL DATABASE

ou can build secure, performance-driven applications Yby implementing stored procedures for accessing data.

Using stored procedures allows you to wrap your data access into precompiled procedures. These procedures can be secured, giving rights to only the users that need access.

If all your data access is put into stored procedures, you can remove direct access to your tables. Stored procedures give you known entry points to your data. If you keep read, update, and delete access enabled on your tables, you cannot protect your data from harmful modification, whether intentional or unintentional.

To implement stored procedures, first determine which provider you want to use, the SQLClient namespace or the OleDb namespace, depending on your database. No

matter which namespace you choose, you need a connection to the data source and a Command object to prepare, execute, and evaluate results of a stored procedure.

The key part of the Command object is collection of parameters. Parameters are used to pass in data that is needed to execute the SQL statements inside the stored procedure and to hold information that the program needs to inspect after the procedure has completed its execution. These output or return parameters may have records of data or just a single value that indicates the result of the execution.

You can shorthand the five lines that are required to prepare and set a parameter into a single line of code. In terms of code execution time, most likely both of these implementations would precompile down to the same Intermediate Language (IL). Which implementation to choose is a matter of style. The more verbose style is typically chosen because it is easier to troubleshoot.

The line of code for adding a parameter

cmdByRoyalty.Parameters.Add("@percentage",SqlDbT ype.Int, 15).Value=50;

can replace the following lines in the code used in the screenshots in this section

SqlParameter prmPercentage = new SqlParameter();

prmPercentage.ParameterName = "@percentageº;

prmPercentage.SqlDbType= SqlDbType.Int;

prmPercentage.Direction=

ParameterDirection.Input;

prmPercentage.Value=50;

■ A message appears showing the results of running the stored procedure.

XML is a great lightweight storage of data for your applications. If you are using Microsoft SQL 2000, you can retrieve queries in the form of XML. You will

sometimes need to pull XML data from files.

To read XML files, you can use an implementation of the XMLReader class. The XMLReader class is an abstract base class that provides noncached, forward-only, read-only access. Because it is an abstract class, you need to use

one of the current implementations in the

System.XML namespace which are XMLTextReader, XMLValidatingReader, and XMLNodeReader classes.

Typically, you use the XMLTextReader if you need to access the XML as raw data. After you load the

XMLTextReader, you will iterate through XML data by using the Read method, sequentially retrieving the next record from the document. The Read method returns false if no more records exist. To process the XML data, each record has a node type that can be determined from the NodeType property. This NodeType property will help you determine how to process the node. The

XMLTextReader class will enforce the XML rules but does not provide data validation.

‚ Add a switch statement to check for element types.

— Create a case for an element type and write the XML to the console.

± Add a default case that does nothing.

¡ Set a debug stop.

™ Press F5 to save, build, and run the console application.

■ The contents of the XML file are displayed in

the console.