how to place images into sql server 2005

Question

I have written the following code to place the image path into sql server 2005 but its not working is their any alternate way to place images into sql server from clientside application.

example.html

<form id="addresslistingform">
                  <fieldset id="fieldset1"><legend>Address for listing</legend>
                Zipcode:<br/>
                  <input size="30" type="text" id="zipcode"/><br/>
                Street No:<br/>
                  <input size="30" type="text" id="addstreetno" class="number" name="streetno"/><br/>
                Street Name:<br/> 
                  <input size="30" type="text" id="addstreetname" class="required" name="streetname"/><br/>                            
                Upload a couple of pictures:<br>
              <input size="30" type="file" id="addpicture"/> <br>                 
              </fieldset>

             <input id="Addresslisting" type="image" src="images/Submit.png" align="left"  />                   
 </form>

example.js

    $("#Addresslisting").click(function() {
       var zipcode = ($("#addzipcode").val());
        var streetno = ($("#addstreetno").val());
        var streetname = ($("#addstreetname").val());
        var image = ($("#addpicture").val());
         var submitaddress = "{\"zipcode\":\"" + zipcode + "\",\"streetnumber\":\"" + streetno + "\",\"streetname\":\"" + streetname + "\",\"streetname\":\"" + streetname + "\",\"Imagelocation\":\"" + image + "\"}";
            $.ajax({
                type: "POST",
                url: "/exampleproject/Afterlogin.asmx/addresslisting",
                data: submitaddress,
                contentType: "application/json; charset=utf-8",
                success: ajaxSucceed,
                dataType: "json",
                failure: ajaxFailed
            });

});

asmx webservices file

[WebMethod(EnableSession = true)]
    [ScriptMethod(ResponseFormat = ResponseFormat.Json)]
    public bool addresslisting(string zipcode, string streetnumber, string streetname,  string Imagelocation)
    {
        SqlConnection con = new SqlConnection();
        con.ConnectionString = "";
        con.Open();

        SqlCommand sqlcom = new SqlCommand();//declaring a new command
        sqlcom.CommandText = "insert into Address_Listing(Zip_Code,Street_Number,Street_Name,Image_Location) values ('" + zipcode + "','" + streetnumber + "','" + streetname + "',  '" + Imagelocation + "')"; //query for inserting data into contact table
        sqlcom.Connection = con;//connecting to database

        try
        {
            int success = sqlcom.ExecuteNonQuery();
            con.Close();

            if (success > 0)
            {
                return true;
            }
            else
            {
                return false;
            }
        }
        catch (Exception e)
        {
            con.Close();
            return false;
        }


    }

Answer 1

FYI, there are a number of problems with your code. It should be more like this:

public bool addresslisting(string zipcode, string streetnumber, string streetname, string Imagelocation)
{
    using (SqlConnection con = new SqlConnection())
    {
        con.ConnectionString = "";
        con.Open();

        using (SqlCommand sqlcom = new SqlCommand())
        {
            sqlcom.CommandText =
                string.Format(
                    "insert into Address_Listing(Zip_Code,Street_Number,Street_Name,Image_Location) " +
                    "values ('{0}','{1}','{2}',  '{3}')",
                    zipcode, streetnumber, streetname, Imagelocation);
            sqlcom.Connection = con;

            int success = sqlcom.ExecuteNonQuery();

            return success > 0;
        }
    }
}

1. using blocks will ensure that resources are released, even if an exception is thrown
2. Never hide exceptions. By returning "false" you are hiding whatever problem caused the exception to be thrown.
3. I certainly hope you have sanitized zipcode, streetnumber, etc., otherwise your code is potentially vulnerable to a SQL Injection Attack.