I want to pass an SQL-ending as a view param to GeoServer using WMTS. E.g. something like:


for my SQL view layer where the FILTER-variable has the following regex-validation: ^[\w\d\s\ ]+$.

The query looks something like this:


I'm getting this error from the GeoServer:

WARN [org.geoserver.ows] - Unable to parse filter: ORDER BY road_class
org.xml.sax.SAXParseException; lineNumber: 1; columnNumber: 1; Content is not allowed in prolog.

Is this at all possible, or is there some SQL-inject filter? Or is this some kind of validation error where GeoServer is unable to handle spaces?

1 Answer 1


No, it's because "filter" is a reserved key, it already has a meaning in the URL. Please use keys that cannot appear in the URL.

Important aside: that general filter expansion is very dangerous, make sure you setup a validation regular expression that can prevent SQL injection attacks (difficult, in general).

Second important aside: the query you give to GeoServer is not run directly but used as a sub-query in a larger query that has the spatial filter, property selection, and the like. The order you're trying to get is unlikely to work. For that use case it's best to use the sortBy parameter instead.

  • Thanks, worked when using some other param-name. I will need to pass other filters as well which sortBy-parameter won't cover. Also looked into CQL-filters, but that doesn't seem to have an effect. True about the dangerousness, I'll make sure to protect the endpoint and only allow requests through a proxy and make the db-connection-privileges read-only.
    – Jesper
    Commented Oct 29, 2021 at 14:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.