Tell me more ×
Geographic Information Systems Stack Exchange is a question and answer site for cartographers, geographers and GIS professionals. It's 100% free, no registration required.
up vote 1 down vote favorite

I am querying a point feature using a POSTGIS request fired in Javascript. The decoded URL looks like this and returns great results for polygon features.

http://test.tablelocation.com/api/v1/sql/?q=select '+tempCoi+' from '+tempTableName+' where ST_Intersects(the_geom, ST_GeomFromText('POINT('+clickLng+' '+clickLat+')',4326))&format=json&diagnostics=true&_maxage=86400&callback=?

As you can see, there are a few dynamic Javascript variables that are injected into each URL request. Two of these variables (clickLng and clickLat) specify the lat/lng of my query. They are generated based on where the user clicks on a google map. I am returning one attribute from the point layer referenced via the tempCoi variable. When I try to query a point feature, no data is returned.

I am guessing that this is because the location of my query is too specific (i.e. 6+ decimal points).

To make a long question shorter, is there a way to fuzz my data request.

For example, if I click at 45.123456N and -113.654987W how could I look for the closest point to that query?

Hope this is clear..

thanks in advance..

-j

share|improve this question

1 Answer

up vote 1 down vote accepted

Passing SQL in your URLs directly looks risky to me.

Otherwise, the method you are looking for is http://postgis.refractions.net/docs/ST_DWithin.html

share|improve this answer
Thanks Relet.. I'll look into ST_DWithin. Why is passing URLs risky? I am pretty new to web development. – snowgage Mar 28 '12 at 13:02
Passing SQL code is risky. What happens if someone calls that URL with q=drop+database+yourdatabasename ? You may have set the correct permissions to disallow that, but in general database permissions are not fine grained enough to prevent all forms of possible abuse (for a less drastic example, reading data from tables that shouldn't be public). – relet Mar 28 '12 at 13:18
php is good for hiding all the db info from webusers - novaksblog.com/2007/10/02/database-connection-with-php is a better way to stop someone droping tables in databases.. – Mapperz♦ Mar 28 '12 at 14:17

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.