如何将图像放入sql server 2005

Question

我编写了以下代码来将图像路径放入 sql server 2005，但它不起作用是他们从客户端应用程序将图像放入 sql server 的任何替代方法。

example.html

<form id="addresslistingform">
                  <fieldset id="fieldset1"><legend>Address for listing</legend>
                Zipcode:<br/>
                  <input size="30" type="text" id="zipcode"/><br/>
                Street No:<br/>
                  <input size="30" type="text" id="addstreetno" class="number" name="streetno"/><br/>
                Street Name:<br/> 
                  <input size="30" type="text" id="addstreetname" class="required" name="streetname"/><br/>                            
                Upload a couple of pictures:<br>
              <input size="30" type="file" id="addpicture"/> <br>                 
              </fieldset>

             <input id="Addresslisting" type="image" src="images/Submit.png" align="left"  />                   
 </form>

example.js

    $("#Addresslisting").click(function() {
       var zipcode = ($("#addzipcode").val());
        var streetno = ($("#addstreetno").val());
        var streetname = ($("#addstreetname").val());
        var image = ($("#addpicture").val());
         var submitaddress = "{\"zipcode\":\"" + zipcode + "\",\"streetnumber\":\"" + streetno + "\",\"streetname\":\"" + streetname + "\",\"streetname\":\"" + streetname + "\",\"Imagelocation\":\"" + image + "\"}";
            $.ajax({
                type: "POST",
                url: "/exampleproject/Afterlogin.asmx/addresslisting",
                data: submitaddress,
                contentType: "application/json; charset=utf-8",
                success: ajaxSucceed,
                dataType: "json",
                failure: ajaxFailed
            });

});

asmx webservices 文件

[WebMethod(EnableSession = true)]
    [ScriptMethod(ResponseFormat = ResponseFormat.Json)]
    public bool addresslisting(string zipcode, string streetnumber, string streetname,  string Imagelocation)
    {
        SqlConnection con = new SqlConnection();
        con.ConnectionString = "";
        con.Open();

        SqlCommand sqlcom = new SqlCommand();//declaring a new command
        sqlcom.CommandText = "insert into Address_Listing(Zip_Code,Street_Number,Street_Name,Image_Location) values ('" + zipcode + "','" + streetnumber + "','" + streetname + "',  '" + Imagelocation + "')"; //query for inserting data into contact table
        sqlcom.Connection = con;//connecting to database

        try
        {
            int success = sqlcom.ExecuteNonQuery();
            con.Close();

            if (success > 0)
            {
                return true;
            }
            else
            {
                return false;
            }
        }
        catch (Exception e)
        {
            con.Close();
            return false;
        }


    }

Answer 1

仅供参考，您的代码存在许多问题。应该更像是这样：

public bool addresslisting(string zipcode, string streetnumber, string streetname, string Imagelocation)
{
    using (SqlConnection con = new SqlConnection())
    {
        con.ConnectionString = "";
        con.Open();

        using (SqlCommand sqlcom = new SqlCommand())
        {
            sqlcom.CommandText =
                string.Format(
                    "insert into Address_Listing(Zip_Code,Street_Number,Street_Name,Image_Location) " +
                    "values ('{0}','{1}','{2}',  '{3}')",
                    zipcode, streetnumber, streetname, Imagelocation);
            sqlcom.Connection = con;

            int success = sqlcom.ExecuteNonQuery();

            return success > 0;
        }
    }
}

1. using 块将确保资源被释放，即使抛出异常
2. 也绝不隐藏异常。通过返回“false”，您将隐藏导致抛出异常的任何问题。
3. 我当然希望您已经清理了邮政编码、街道号码等，否则您的代码可能容易受到 SQL 注入攻击。