jasonfz
Premier Customer
- Joined
- Nov 19, 2022
- Messages
- 22
- Reaction score
- 19
The single quotes are required for MSSQL.Remove the single quotes around the parameter @ANI. Apart from that it should be ok.
SQL injection is avoided because by using parameters, if the parameter value has SQL code to change the meaning of your SQL command, the parameter will escape it in a way that will not execute the desired code. In your case you're passing the caller's number, which will not have a tricky value, but this is in general to avoid possible SQL injection if you pass for example a value that you are getting from a web service....
When passing the EXEC command it is required to encapsulate the value in single quotes since that value is not always an integer (the carrier passes the country code so really is passing +18135551212 in these examples).
In other words:
EXEC [CMC-3CX_DAY_LOOKUP_EMR2],'8135551212' <--this is required
not:
EXEC [CMC-3CX_DAY_LOOKUP_EMR2],8135551212 <--this won't work
Therefore would the CFD query be:
"EXEC [CMC-3CX_DAY_LOOKUP_EMR2],'@ANI'"
which appears to pass
EXEC [CMC-3CX_DAY_LOOKUP_EMR2],'@ANI'
to the MSSQL server?
It is difficult for me to test this without updating the production side of things since the MSSQL server in question contains confidential data and cannot be placed in our test environment with our test systems. In order to have valid returns, I have to use the active DB and that impacts call flow in prod so want to get this as close as possible without having to troubleshoot during active calling periods where we get many calls (around 100-200/hour).
I appreciate your help.
