Question

I have the following gridView select command –

SelectCommand="SELECT [columnA] FROM [DB].[dbo].[TABLE] WHERE value = 1

When running it brings back the desired result into the gridview, however I am passing a string value from the previous page to populate a textBox and on page load want the gridview SelectCommand to be determined by that string.

So something like –

<asp:TextBox ID="TextBox1" runat="server"></asp:TextBox>

SelectCommand="SELECT [columnA] FROM [DB].[dbo].[TABLE] WHERE value = <%TextBox1.Text%>

However this is not picking up the string value on page load.

Answer 1

This kind of query is prone to SQL Injection, You can use parameters instead. And Use the value you get from your QueryString.

SqlCommand comm = new SqlCommand();
comm.CommandText = "SELECT [columnA] FROM [DB].[dbo].[TABLE] WHERE value = @value";
comm.Parameters.AddWithValue("value", Request.QueryString["string"]);