Database

ALTER PROCEDURE [dbo].[update_source]<br />
-- Add the parameters for the stored procedure here<br />
@internal_id int,<br />
@parent_id int,<br />
@sstate tinyint,<br />
@title nvarchar(50),<br />
@rng decimal(4,2),<br />
@lat dbo.latitude,<br />
@lon dbo.longtitude,<br />
@course dbo.angle,<br />
@speed dbo.speed,<br />
@stype xml<br />
AS<br />
BEGIN<br />
SET NOCOUNT ON;<br />
DECLARE @source_id int;<br />
DECLARE @state int;<br />
<br />
SET @source_id = (SELECT source_id FROM sources WHERE internal_id = @internal_id);<br />
IF @source_id IS NULL<br />
BEGIN<br />
INSERT INTO sources<br />
(internal_id, parent_id, updated, sstate, title, rng, course, speed, stype,lat,lon)<br />
VALUES<br />
(@internal_id, @parent_id, getutcdate(), @sstate, @title, @rng, @course, @speed, @stype, @lat*100000000, @lon*10000000);<br />
<br />
SET @source_id = (SELECT source_id FROM sources WHERE internal_id = @internal_id);<br />
END<br />
ELSE<br />
SET @state = (SELECT sstate FROM sources WHERE source_id = @source_id);<br />
UPDATE sources SET<br />
parent_id = @parent_id,<br />
updated = getutcdate(),<br />
sstate = @sstate,<br />
title = @title,<br />
rng = @rng,<br />
course = @course,<br />
speed = @speed,<br />
stype = @stype,<br />
lat = @lat*100000000,<br />
lon = @lon*10000000<br />
WHERE source_id = @source_id;<br />
<br />
<br />
<br />
INSERT INTO source_states<br />
(source_id, sstate, acquired)<br />
VALUES<br />
(@source_id, @sstate, getutcdate());<br />
<br />
END

<br />
EXEC update_source 2190074, 5, 1, N'2190074', 0,57.7386783333333,10.57468,0,0,N'';<br />
EXEC update_source 2573335, 5, 1, N'2573335', 0,63.8,9.73333333333333,0,0,N'';<br />
.....<br />
.....<br />
.....<br />
EXEC update_source 2573105, 5, 1, N'2573105', 0,59.6166666666667,10.5166666666667,0,0,N'';<br />
EXEC update_source 2573235, 5, 1, N'2573235', 0,60.4,5.35,0,0,N'';

string sql= [whatever the user passes in]

SqlConnection connection = new SqlConnection(ConfigurationManager.ConnectionStrings[Utils.GetConnectionString].ToString());
        connection.Open();

        SqlCommand command = connection.CreateCommand();
        command.CommandType = CommandType.Text;
        command.CommandText = sql;


        try
        {
            int result = command.ExecuteNonQuery();

            if (result != 1)
            {
                Response.StatusCode = 500;
                Response.Write("The file has been uploaded, but we could not update the DB");
                Response.End();
            }
        }
        catch (InvalidOperationException)
        {
            Response.Clear();
            Response.Write("error");
            Response.StatusCode = 500;
            Response.End();
        }

        connection.Close();