2

I have used this string and tested it with string concatenation.But as you know it is not safe to use this to format an sql command.

 SqlCommand param = new SqlCommand();
        param.CommandText = "INSERT INTO Circle (Center_Point, Circle_Data) VALUES (geometry::STGeomFromText('POINT(@center_lat @center_lng)',0),geometry::STGeomFromText('POLYGON((@polygon))',0));";
        param.Parameters.Add(new SqlParameter("@center_lat", center_lat));
        param.Parameters.Add(new SqlParameter("@center_lng", center_lng));
        param.Parameters.Add(new SqlParameter("@polygon", polygon));

I go to parametrize the string and get the following error:

System.Data.SqlClient.SqlException (0x80131904): A .NET Framework error occurred during execution of user-defined routine or aggregate "geometry": System.FormatException: 24141: A number is expected at position 17 of the input. The input has @center_lat.

Looks like it hasn't put the value into the string. but when I step through the code it does indeed hold the value.

What could be the problem?

Thanks

15
  • Everything between ' is considered part of the string value, so the parameters won't be replaced by the given values.
    – Me.Name
    Jun 8, 2015 at 9:04
  • Any suggestion on how to get round this?. Im trying ways now..
    – SammyG
    Jun 8, 2015 at 9:21
  • Not sure if there are smarter ways, but to use sql while keeping the parameters intact, you could do something like ... select 'POINT(' + cast(@center_lat as varchar) + ' ' + ..... (NB, The parameter type used determines the number of digits that will be included)
    – Me.Name
    Jun 8, 2015 at 9:43
  • I can concatenate strings fine and it works, but isn't this considered unsafe from an SQL Injection point of view? this is why I am parametrizing it.
    – SammyG
    Jun 8, 2015 at 10:09
  • Not if you concatenate the parameters instead of the values. I reckon the first version used the raw values, in other words the concatenating took place while creating the sql string. (e.g " 'Point(" + center_lat. By using 'POINT(' + @center_lat etc inside your string, you concatenate inside the sql command, still using the parameterized values. Note that as far as visual studio is concerned, you're still using one string value and don't concatenate anything at all.
    – Me.Name
    Jun 8, 2015 at 11:07

2 Answers 2

3

Thanks to Me.Name. I had to add the correct assemblies to the ASP.net project, which enabled me to set the UDT type correctly. Updated Code is below.

SqlCommand param = new SqlCommand();
        SqlGeometry point = SqlGeometry.Point(center_lat,center_lng,0);
        SqlGeometry poly = SqlGeometry.STPolyFromText(new SqlChars(new SqlString(polygon)),0);
        param.CommandText = "INSERT INTO Circle (Center_Point, Circle_Data) VALUES (@point,@poly);";
        param.Parameters.Add(new SqlParameter("@point", SqlDbType.Udt));
        param.Parameters.Add(new SqlParameter("@poly", SqlDbType.Udt));
        param.Parameters["@point"].UdtTypeName = "geometry";
        param.Parameters["@poly"].UdtTypeName = "geometry";
        param.Parameters["@point"].Value = point;
        param.Parameters["@poly"].Value = poly;
0

For me, using MySQL geometry, I had to use the MySqlGeometry class rather than the SqlGeometry as in the answer from @SammyG

parameters.Add(new
{
   ...
   MyGeometryObject = MySqlGeometry.Parse($"POINT({point.WGS84Lon} {point.WGS84Lat})").Value,
});

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.