Incorrect Syntax near "@PasswordHash"

Question

Ok, I've checked a number of different similar issues, but nothing of the similar cases seems to solve my problem, or I'm missing something.

Relevant method:

private void ApplyPasswordToUser(string username, string passwordHash)
{
        using(SqlConnection connection = new SqlConnection(ConnectionString))
        {
            SqlCommand command = new SqlCommand 
            {
                Connection = connection,
                CommandText = "dbo.AddPasswordHash @Username @PasswordHash"
            };

            command.Parameters.Add("@Username",SqlDbType.NVarChar,24).Value = username;
            command.Parameters.AddWithValue("@PasswordHash",passwordHash);

            connection.Open();
            command.ExecuteNonQuery(); // Error here
        }
}

dbo.AddPasswordHash:

    @Username nchar(24),
    @PasswordHash nchar(80)
AS
BEGIN
    SET NOCOUNT ON;

    UPDATE dbo.UserPass
    SET Password_Hash = @PasswordHash
    WHERE Username = @Username
END

I'm using the Blowfish algorithm from the CryptSharp NuGet Package.

I have 3 other commands that don't pass that password hash as input and all work perfectly fine. This one seems to have issued no matter what I seem to change.

The hash contains various special characters in its string, so I'm not sure if that is affecting whether or not the command gets through.

user_13302 · Answer

I would suggest using code like this:

    using(SqlConnection connection = new SqlConnection(ConnectionString))
    {
        SqlCommand command = new SqlCommand("dbo.AddPasswordHash", connection);
        command.CommandType = CommandType.StoredProcedure;

        command.Parameters.Add("@Username", SqlDbType.NChar, 24).Value = username;
        command.Parameters.Add("@PasswordHash", SqlDbType.NChar, 80).Value = passwordHash);

        connection.Open();
        command.ExecuteNonQuery();
    }

Use the proper syntax for calling a stored procedure
Use the proper syntax for defining parameters (with defining their proper types)

Incorrect Syntax near "@PasswordHash"

1 Answers