cleanest way to access sproc data in asp.net

I haven't accessed data using SqlCommand etc. for a while as I tend to use NHibernate these days. I am just wondering whether the following code could be improved. I have tried to use best practises (after some google-ing) and potential exceptions are caught at a highe开发者_Go百科r layer.

[WebMethod]
    public XmlDocument GetClassRegistrationReport()
    {
        XmlDocument doc = new XmlDocument();

        using (SqlConnection connection = new SqlConnection(ConfigurationManager.ConnectionStrings["bla"].ToString()))
        {
            using (SqlCommand command = connection.CreateCommand())
            {
                command.CommandText = "bla";
                command.CommandType = CommandType.StoredProcedure;
                connection.Open();
                doc.Load(command.ExecuteXmlReader());
            }
        }

        return doc;
    }

Thanks!

Best wishes,

Christian

---

There are a few ways you could improve it a little:

• Although the WebMethod pulls data and returns it verbatim with no input parameters, I would suggest seperating service interface and the data into seperate classes. It may make things easier to maintain at a later date.
• Assuming there are other DB calls in your framework you may want to consider a helper method in your data layer that wraps up the invocation of a stored procedure. This way you only have one method that all SP calls filter down into which again will make things easier to maintain in the future.
• Make the 'bla' key for your connection string setting a constant, this way you can easily reuse and change.
• The same applies to the name of the stored procedure, alternatively make it part of your web.config - this means you can change the stored proc name without having to recompile.
• If an exception is throw there is no handling for this so the exception will bubble out to the caller, consider catching and handling/logging exceptions. That said you do mention that you are handling exceptions at a higher layer, so I assume this is being done in whatever is calling your webservices.
• You should be disposing the SQL command object (in the finally of the try/catch/finally if you do implement exception handling)

EDIT : Code Sample

public class MyWebService
{
    [WebMethod]
    public XmlDocument GetClassRegistrationReport()
    {
        return DataLayer.GetClassRegistrationReport();
    }
}
// Notice that this is a static internal class, internal to hide the
// data access class from everything but this library and static because
// we don't need instances and using statics will optimise a little.
internal static class DataLayer
{
    private const string SP_GetRegistrationReport = "GetRegistrationReport";
    private const string Config_DBConnectionString = "PrimaryDB";

    private static string GetDB
    {
        get
        {
            string dbConnectionString = ConfigurationManager.ConnectionStrings[Config_DBConnectionString].ConnectionString;

            if (string.IsNullOrEmpty(dbConnectionString))
            {
                // This error should could/should be in a resource file.
                throw new ConfigurationException("Database connection string is not defined");
            }

            return dbConnectionString;
        }
    }

    internal static XmlDocument GetClassRegistrationReport()
    {
        XmlDocument doc = new XmlDocument();

        using (SqlConnection connection = new SqlConnection())
        {
            using (SqlCommand command = connection.CreateCommand())
            {
                command.CommandText = SP_GetRegistrationReport;
                command.CommandType = CommandType.StoredProcedure;
                connection.Open();
                doc.Load(command.ExecuteXmlReader());
            }
        }

        return doc;
    }
}