how to place images into sql server 2005 [duplicate] - sql-server-2005

Question

This question already has answers here:
How to save an image from SQL Server to a file using SQL [closed]
(4 answers)
Closed 8 years ago.
I have written the following code to place the image path into sql server 2005 but its not working is their any alternate way to place images into sql server from clientside application.
example.html
<form id="addresslistingform" name="addresslistingform">
<fieldset id="fieldset1">
<legend>Address for listing</legend> Zipcode:<br />
<input size="30" type="text" id="zipcode" /><br />
Street No:<br />
<input size="30" type="text" id="addstreetno" class="number" name=
"streetno" /><br />
Street Name:<br />
<input size="30" type="text" id="addstreetname" class="required" name=
"streetname" /><br />
Upload a couple of pictures:<br />
<input size="30" type="file" id="addpicture" /><br />
</fieldset><input id="Addresslisting" type="image" src="images/Submit.png" align=
"left" />
</form>
example.js
$("#Addresslisting").click(function () {
var zipcode = ($("#addzipcode").val());
var streetno = ($("#addstreetno").val());
var streetname = ($("#addstreetname").val());
var image = ($("#addpicture").val());
var submitaddress = "{\"zipcode\":\"" + zipcode + "\",\"streetnumber\":\"" + streetno + "\",\"streetname\":\"" + streetname + "\",\"streetname\":\"" + streetname + "\",\"Imagelocation\":\"" + image + "\"}";
$.ajax({
type: "POST",
url: "/exampleproject/Afterlogin.asmx/addresslisting",
data: submitaddress,
contentType: "application/json; charset=utf-8",
success: ajaxSucceed,
dataType: "json",
failure: ajaxFailed
});
});
asmx webservices file
[WebMethod(EnableSession = true)]
[ScriptMethod(ResponseFormat = ResponseFormat.Json)]
public bool addresslisting(string zipcode, string streetnumber, string streetname, string Imagelocation)
{
SqlConnection con = new SqlConnection();
con.ConnectionString = "";
con.Open();
SqlCommand sqlcom = new SqlCommand();//declaring a new command
sqlcom.CommandText = "insert into Address_Listing(Zip_Code,Street_Number,Street_Name,Image_Location) values ('" + zipcode + "','" + streetnumber + "','" + streetname + "', '" + Imagelocation + "')"; //query for inserting data into contact table
sqlcom.Connection = con;//connecting to database
try
{
int success = sqlcom.ExecuteNonQuery();
con.Close();
if (success > 0)
{
return true;
}
else
{
return false;
}
}
catch (Exception e)
{
con.Close();
return false;
}

Answer 1

I do not recommend storing images in SQL server, what you really should do is store the path to the image on your server in the SQL server.
Also p.campbell wasn't very helpful but very correct. Your database is going to get hacked with the code you currently have. You need to use SQL Parameters to prevent malicious SQL code from being injected.
http://msdn.microsoft.com/en-us/library/system.data.sqlclient.sqlparameter.aspx