Ummm OK, and which line throws the invalid cast exception?

Why do you thing this is to do with the SqlConnection? It could be in GetLoginUser, DataTools.EscapeMask or that the stored procedure doesn't return a short as you have coded. What type doe the stored procedure return?

I have to warn you that this isn't a great way to do data access. For a start the database is actually going to execute

sp_executeSql(EXEC checkpermission ...)

So you should do
SqlCommand objcmd = new SqlCommand("[checkpermission]");
objcmd.CommandType = CommandType.StoredProcedure;

The add the parameters via the parameters collection as you also have the possibility of a SQL injection attack by using string concatenation (although luckily your strings don't appear based on, at least directly, user input).

Regards

Richard Blewett - DevelopMentor
http://staff.develop.com/richardb/weblog

  nntp://news.microsoft.com/microsoft.public.dotnet.framework/<#KKSDiGqEHA.3668@TK2MSFTNGP15.phx.gbl>

This is my assembly object's method:


public static bool CheckPermission(SqlConnection objconn, string
permissionitem, string itemname, string loginuser)
{
SqlCommand objcmd = new SqlCommand("EXEC [checkpermission]
@permissionitem = '" + DataTools.EscapeMask(permissionitem) + "', @itemname
= '" + DataTools.EscapeMask(itemname) + "', @loginacc = '" +
DataTools.EscapeMask(GetLoginUser(loginuser, LoginAccount)) + "', @logincus
= '" + DataTools.EscapeMask(GetLoginUser(loginuser, LoginCustomer)) + "'",
(SqlConnection)objconn);
short intresult = (short)objcmd.ExecuteScalar();
bool checkresult;

if(intresult > 0)
{
checkresult = true;
}
else
{
checkresult = false;
}

objcmd.Dispose();

return checkresult;
}


This is my code of ASP.NET page which using the method:


SqlConnection objconn = new
SqlConnection(ConfigurationSettings.AppSettings["connstr_webhosting"]);
objconn.Open();

bool permited = (bool)CPanel.CheckPermission(objconn, "systeminfo",
"yes", User.Identity.Name);


How to solve it?


"Richard Blewett [DevelopMentor]" <richardb@develop.com> ?b?l??
news:uiz4%23tFqEHA.2900@TK2MSFTNGP12.phx.gbl ?????g...

connection and what you do with it when you get it

nntp://news.microsoft.com/microsoft.public.dotnet.framework/<ud$vTSFqEHA.2456@TK2MSFTNGP10.phx.gbl>

use

the

[microsoft.public.dotnet.framework]

Looks functional.
Byzantine.
But functional.

I agree with Richard... set up your command object to execute a stored
procedure and create the parameters individually.

Then, at least, if you are getting a casting error from one of the other
methods in your long concatenated (rather tortured) string, you will be able
to tell which one!  I also agree that the problem is probably either in the
DataTools.EscapeMask method (a static method, apparently), or the
GetLoginUser method.  It probably has nothing to do with the SqlConnection
object.

--- Nick

nntp://news.microsoft.com/microsoft.public.dotnet.framework/<ud$vTSFqEHA.2456@TK2MSFTNGP10.phx.gbl>