using QueryString in ASPX file

Question

I am trying to use sql command in ASPX file to capture a querysring value but having some syntax issue. Everything works fine but when i try to filter it by querystring then i get the syntax issue. How can i filter it my query using the querystring? Here is my code:

<asp:SqlDataSource ID="DD_AI_DS" runat="server" 
              ConnectionString="<%$ ConnectionStrings:MyConnectionString %>" 
              SelectCommand="SELECT DISTINCT [MyField] FROM [MyTable] where ID = '"+request.querystring[ID]+"' order by ID asc" >
          </asp:SqlDataSource>

QueryStringParameter: msdn.microsoft.com/en-us/library/… — Garrison Neely
– Garrison Neely, Commented Aug 12, 2013 at 20:58
This code is open to a SQL Injection attack - stackoverflow.com/questions/332365/… — shf301
– shf301, Commented Aug 12, 2013 at 21:01
i had to add this <SelectParameters> <asp:QueryStringParameter Name="ID" QueryStringField="Post_ID" Type="String" /> — moe
– moe, Commented Aug 12, 2013 at 21:01

rtpHarry · Accepted Answer · 2013-08-13 12:26:45Z

4

Try this instead:

<asp:SqlDataSource ID="DD_AI_DS" runat="server" 
   ConnectionString="<%$ ConnectionStrings:MyConnectionString %>" 
   SelectCommand="SELECT DISTINCT [MyField] FROM [MyTable] where ID = @ID order by ID asc" >
   <SelectParameters>
    <asp:QueryStringParameter Name="ID" QueryStringField="Post_ID" Type="String" />
   </SelectParameters>
</asp:SqlDataSource>

As an aside, if the code you had written had actually worked then it would have created a security hole in your website by allowing sql injection. I would read up on this topic so you don't accidentally make your websites open to hackers.

edited Aug 13, 2013 at 12:26

answered Aug 12, 2013 at 21:01

rtpHarry

13.2k4 gold badges45 silver badges64 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Karl Anderson · Accepted Answer · 2013-08-12 21:01:27Z

0

You can also set the SqlDataSource properties in code-behind, like this:

DD_AI_DS.SelectCommand = "SELECT DISTINCT [MyField] FROM [MyTable] where ID = '"+ Request.QueryString[ID] + "' order by ID asc";
DD_AI_DS.Select(DataSourceSelectArguments.Empty);

Note: This gives you the support of IntelliSense in Visual Studio and catching some issues at compile-time.

answered Aug 12, 2013 at 21:01

Karl Anderson

34.9k12 gold badges69 silver badges83 bronze badges

1 Comment

Garrison Neely Over a year ago

Aww, Karl, don't give him code that keeps the injection attack in there!

Collectives™ on Stack Overflow

using QueryString in ASPX file

2 Answers 2

Comments

1 Comment

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

1 Comment

Your Answer

Sign up or log in

Post as a guest

Linked

Related