ORA-00911: invalid character in C#, but not Oracle SQL Developer

Question

I have a code line that's throwing an

Oracle Exception - ORA-00911: invalid character

when trying the following C# code:

double tempDateTimeObj = Convert.ToDouble(someClass.GetTime(tempObjID, objStartTime, todayTime).Rows[0][0]);

GetTime is a function that makes an SQL call that takes in the variables you see above, and the SQL call OUTs a Oracle number type and then the GetTime C# function returns a DataTableCollection Tables object of one row each time.

public static DataTable GetTime(string tempObjID, DateTime objStartTime, DateTime todayTime)
{

    string sql = "select some_pkg.get_time('" + tempObjID + "', to_date('" + objStartTime + "', 'mm/dd/yyyy hh:mi:ss am'), to_date('" + todayTime + "', 'mm/dd/yyyy hh:mi:ss am')) from dual;";

    return <connection object>.getDS(sql).Tables[0];
}

If I debug, grab the sql string having values for the variables, and throw it into Oracle SQL Developer, it works just fine and returns a number in the SQL Dev console. However when I debug and come across that line, the C# code throws the 00911 exception. Since the string sql has been tested in Oracle SQL Dev, the syntax should be valid. Given valid syntax, why is VS2010 throwing this error/exception?

EDIT: Here is a sample string of what's being built in C# and sent to the DB:

select some_pkg.get_time('23569245', to_date('11/8/2012 1:21:06 PM', 'mm/dd/yyyy hh:mi:ss am'), to_date('12/31/2012 12:52:18 AM', 'mm/dd/yyyy hh:mi:ss am')) from dual

Having a semi-colon and not having semi-colon in the C# string have been tried and resulted in the same Oracle exception despite both working in Oracle SQL Dev

Answer 1

At a minimum, you don't want the trailing semicolon in the SQL statement you send from C#.

I would strongly advocate as well that you use bind variables rather than concatenating together a string with your SQL statement. That will be more efficient, it will prevent shared pool related errors, it will make your DBA much happier, and it will protect you against SQL injection attacks.