Problem with output data when calling into Oracle stored procedure

Question

I have a problem that I think I've seen posted by others, but I can't find it anywhere on the forum. Here's what it looks like:
I have a application that sends a query parameter called custID in a URL to a JSP page.
http://domain.com/decrypt.jsp?custID=ewsw
The JSP subsequently calls into the method below to run a decryption stored procedure on an Oracle db. The custId parameter works fine from most clients. However, I have seen the decryption stored procedure return invalid information on some clients in the following case:
http://domain.com/decrypt.jsp?custID='eirwx
Here is how I define my call to the DCUSTID (decryption stored procedure):
public long dCustID(String sCustID)throws SQLException {
CallableStatement cs = null;
try {
long nCustID = 0;
if(conn == null || conn.isClosed()) {getLocalConnection();}
String sp = "BEGIN DCUSTID(?,?);END;";
cs = conn.prepareCall(sp);
cs.setString(1, sCustID);
cs.registerOutParameter(2,java.sql.Types.NUMERIC);
cs.execute();
nCustID = cs.getLong(2);
return nCustID;
}finally { release(cs); }
I have not been able to find a problem with the stored procedure (although Im not counting that out). Is there any way that the jsp or the code above is corrupting the data before it gets to the stored procedure? I'm very suspicious of the single quote at the begining of the custID query string parameter.
Thanks

Answer 1

>
The JSP subsequently calls into the method below to
run a decryption stored procedure on an Oracle db.
The custId parameter works fine from most clients.
However, I have seen the decryption stored procedure
e return invalid information on some clients in the
following case:
The back tick doesn't matter.
How do you know that the routine that you posted returns invalid information? Are you printing the value retreived before you return in the code that you posted? That is the only way to tell if that code is the problem vs some translation problem in something else.
And what do you mean by 'invalid'? It does return a numeric value right? Is it negative? Or so large that it couldn't be a key? Or what?
The input parameter to the stored proc is a varchar and not a char correct?