Take the 2-minute tour ×
Geographic Information Systems Stack Exchange is a question and answer site for cartographers, geographers and GIS professionals. It's 100% free, no registration required.

How can I add a HTML search bar that the user can use to search an attribute field for a polygon layer, and then tie that input into the SQL statement?

So far I am able to hard code the query of sending a SQL statement and returning a answer using cartodb. My problem is figuring out how to take the input from the search box and automatically inserting the input into the sql statement.

I am using Cartodb api.

 var sql = new cartodb.SQL({ user: 'jmann111' });
   sql.getBounds("select * from stations where station_nm like ='%" + user_input +"'").done(function(bounds) {
  map.fitBounds(bounds)
  });
share|improve this question
2  
for connecting to SQL you should do this on the server not the client - using php can do this stackoverflow.com/questions/7795791/… –  Mapperz Jul 26 '13 at 19:13
1  
my user input is '; drop table stations; --. I hope you have a backup...what i mean is you are opening yourself to a huge SQL Injection vulnerability. –  til_b May 6 at 6:44

1 Answer 1

In SQL you will need a parameter, usually declared somewhere before the select statement. The parameter is the same as a variable. So something like: Declare @userinput as varchar Set @userinput = textbox.text Select * From stations where Station_nm Like '%@userinput%'

Your command has like = and they can't be used together.

share|improve this answer
    
Thank you User20498 this is what i was looking for how ever still having problems implementing this practice even just setting the parameter to a default value I am getting a syntax error for in my Declare parameter @ –  CrazySpatial Jul 29 '13 at 12:54
    
to CrazySpatial , command should be Like '%' + @userinput instead of = . But that looks like it is vulnerable to sql injection. I strongly recommend that you read about it –  simplexio Jan 9 at 8:24

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.