'参数无效。' 尝试从数据库 MySql 检索图像时

Question

I'm working on winForms a project where the user will be able to draw a signature with his cursor and save it in a database.

This is how I'm saving it:

ExecuteQuery("INSERT INTO signatures (name, signature) VALUES ('"+ TXTname.Text +"','"+ signature +"')");

(this is not giving me any error)

keep in mind signature column type is blob.

Then, I want the user to retrive his signature from the database to a picturebox, this is how I'm trying to do it:

 DBconnection.Open();

                Image signature;

                string query = "SELECT * FROM signatures WHERE name = '" + CMBnames.Text + "'";

                var queryCmd = new MySqlCommand(query, DBconnection);

                reader = queryCmd.ExecuteReader();

                while (reader.Read())
                {
                    byte[] img = (byte[])(reader["SIGNATURE"]);
                    if (img == null)
                    {
                        CMBnames.Text = "error";
                    }
                    else
                    {
                        MemoryStream ms = new MemoryStream(img);

                        pictureBox2.Image = System.Drawing.Image.FromStream(ms);
                    }
                }

DBconnection.Close();

But I get this error 'Parameter is not valid.' here:

pictureBox2.Image = System.Drawing.Image.FromStream(ms);

What am I doing wrong?

Answer 1

If signature is a byte[] then '"+ signature +"' will generate the literal string 'System.Byte[]' . This is not a valid image, and reading it back will produce the error you're seeing.

You need to use command parameters, not string concatenation:

using var cmd = new MySqlCommand(@"INSERT INTO signatures (name, signature)
    VALUES (@name, @signature);", DBconnection);
cmd.Parameters.AddWithValue("@name", TXTname.Text);
cmd.Parameters.AddWithValue("@signature", signature);
cmd.ExecuteNonQuery();