I have used this string and tested it with string concatenation.But as you know it is not safe to use this to format an sql command.
SqlCommand param = new SqlCommand();
param.CommandText = "INSERT INTO Circle (Center_Point, Circle_Data) VALUES (geometry::STGeomFromText('POINT(@center_lat @center_lng)',0),geometry::STGeomFromText('POLYGON((@polygon))',0));";
param.Parameters.Add(new SqlParameter("@center_lat", center_lat));
param.Parameters.Add(new SqlParameter("@center_lng", center_lng));
param.Parameters.Add(new SqlParameter("@polygon", polygon));
I go to parametrize the string and get the following error:
System.Data.SqlClient.SqlException (0x80131904): A .NET Framework error occurred during execution of user-defined routine or aggregate "geometry": System.FormatException: 24141: A number is expected at position 17 of the input. The input has @center_lat.
Looks like it hasn't put the value into the string. but when I step through the code it does indeed hold the value.
What could be the problem?
Thanks
'
is considered part of the string value, so the parameters won't be replaced by the given values.... select 'POINT(' + cast(@center_lat as varchar) + ' ' + .....
(NB, The parameter type used determines the number of digits that will be included)" 'Point(" + center_lat
. By using'POINT(' + @center_lat etc
inside your string, you concatenate inside the sql command, still using the parameterized values. Note that as far as visual studio is concerned, you're still using one string value and don't concatenate anything at all.