# Stored procedure with MSSQL-Plus node

**URL:** <https://discourse.nodered.org/t/stored-procedure-with-mssql-plus-node/36466>\
**Category:** General\
**Created:** [24 November 2020 16:46 UTC](https://discourse.nodered.org/t/stored-procedure-with-mssql-plus-node/36466 "2020-11-24T16:46:49Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![grant1](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/grant1/32/49890_2.png) [@grant1](https://discourse.nodered.org/u/grant1)\
**Post date:** [24 November 2020 16:46 UTC](https://discourse.nodered.org/t/stored-procedure-with-mssql-plus-node/36466/1 "2020-11-24T16:46:50Z")

</div>

Hello. I have been successfully executing SQL queries via the MSSQL-Plus node for many months, and am now trying to execute a very simple stored procedure. I am getting the error(s) shown below and have attempted various changes with no success. All that is happening is here is I am trying to use an integer value (in this case 257, whose path is payload[0].CustomerID) as an input to the stored procedure. Hoping the fix is something small and obvious. Thank you.

 ![NR-SQL](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/3X/b/c/bcb7b5951985f25b6e67e44aeaf5e094a10b5ba1.png)

---

<div class="post-metadata">

**Author:** ![Steve-Mcl](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/steve-mcl/32/4826_2.png) [@Steve-Mcl](https://discourse.nodered.org/u/Steve-Mcl)\
**Post date:** [24 November 2020 19:04 UTC](https://discourse.nodered.org/t/stored-procedure-with-mssql-plus-node/36466/2 "2020-11-24T19:04:10Z")

</div>

The answer is to remove EXEC (this for executing stored procedures in a query)

This is how it should be setup properly to avoid SQL injection...

 ![image](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/3X/1/3/1354b15f2fc12386af703f28b7874bf90839bc07.png)

---

<div class="post-metadata">

**Author:** ![grant1](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/grant1/32/49890_2.png) [@grant1](https://discourse.nodered.org/u/grant1)\
**Post date:** [24 November 2020 21:57 UTC](https://discourse.nodered.org/t/stored-procedure-with-mssql-plus-node/36466/3 "2020-11-24T21:57:59Z")

</div>

Thank you for the helpful annotated screenshot. I got the simple stored procedure working and have now moved on to a slightly more complex one that requires **3 inputs** :

EXEC dbo.USP\_InsertCustomerReportRequests 17, 'name@example.com', 'xrptCustomerInventory'

The 1st parameter is the CustomerID and is obtained earlier and defined as msg.payload[0].CustomerID

The 2nd parameter is the email address of the person making the request and is defined earlier as msg.from

The 3rd parameter will always be exactly what you see above, i.e. xrptCustomerInventory

Below is a screenshot of the error that I am getting. I have tried the part in yellow with and without the ' marks, but still get the same result.

 ![NR-SQL--2](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/3X/9/4/949c21c88add27d3ff18f497e209b4277faf00ed.png)

---

<div class="post-metadata">

**Author:** ![Steve-Mcl](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/steve-mcl/32/4826_2.png) [@Steve-Mcl](https://discourse.nodered.org/u/Steve-Mcl)\
**Post date:** [24 November 2020 22:11 UTC](https://discourse.nodered.org/t/stored-procedure-with-mssql-plus-node/36466/4 "2020-11-24T22:11:48Z")

</div>

Where you have entered the report name, the type is alread set to `string` so it doesnt need the quotes.

so try `xrptCustomerInventory` instead of `'xrptCustomerInventory'`

---

<div class="post-metadata">

**Author:** ![grant1](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/grant1/32/49890_2.png) [@grant1](https://discourse.nodered.org/u/grant1)\
**Post date:** [24 November 2020 23:30 UTC](https://discourse.nodered.org/t/stored-procedure-with-mssql-plus-node/36466/5 "2020-11-24T23:30:13Z")

</div>

Thank you. It works perfectly now.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/1X/d073cd938eafa2e558d7c2cd59003b3ef4963033.png) [@system](https://discourse.nodered.org/u/system)\
**Post date:** [8 December 2020 23:30 UTC](https://discourse.nodered.org/t/stored-procedure-with-mssql-plus-node/36466/6 "2020-12-08T23:30:13Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.