Use SQL Server Stored Procedure Output Parameters Correctly

A SQL Server output parameter is still an input parameter unless the procedure declaration marks it OUTPUT. The caller must also pass it with OUTPUT; client libraries additionally need the parameter direction configured before execution.

Last updated: September 29, 2026.

CREATE OR ALTER PROCEDURE dbo.CreateOrder
  @CustomerId int,
  @OrderId int OUTPUT
AS
BEGIN
  SET NOCOUNT ON;

  INSERT dbo.Orders (CustomerId, CreatedAt)
  VALUES (@CustomerId, SYSUTCDATETIME());

  SET @OrderId = CONVERT(int, SCOPE_IDENTITY());
END;
GO

DECLARE @NewOrderId int;
EXEC dbo.CreateOrder
  @CustomerId = 42,
  @OrderId = @NewOrderId OUTPUT;
SELECT @NewOrderId AS OrderId;

The parameter is declared once in the procedure and supplied again by the caller. Omitting either OUTPUT keyword prevents the value from crossing that boundary as intended.

Configure application parameters before execution

In ADO.NET, add the parameter to the command, give it the matching SQL type, and set its Direction to ParameterDirection.Output or InputOutput. Do not infer SQL type or size from a null value. Execute the command first, then read the parameter’s Value. Microsoft documents the available directions in the ParameterDirection reference.

Separate output values from result sets

Use an output parameter for a small scalar value such as a generated ID or status code. Return rows with a SELECT result set, and reserve the integer RETURN value for procedure status when that convention is useful. Microsoft’s stored-procedure return-data guide compares these mechanisms.

If an application reports that a required parameter was not supplied, compare the command’s parameter name with the procedure definition and verify that the application is calling the intended database and schema.

Verify the database boundary

Test the procedure directly in SQL Server Management Studio using the pattern above. Then test through the application connection. When moving databases between servers, confirm login mappings with the post-restore login checklist. For secure application connectivity, review encrypted SQL Server connections and, from PHP, the PDO_SQLSRV connection example.

Related Web Cheat Sheet guides

Sergey Kornilov

Sergey Kornilov