c# - using QueryString in ASPX file -


i trying use sql command in aspx file capture querysring value having syntax issue. works fine when try filter querystring syntax issue. how can filter query using querystring? here code:

<asp:sqldatasource id="dd_ai_ds" runat="server"                connectionstring="<%$ connectionstrings:myconnectionstring %>"                selectcommand="select distinct [myfield] [mytable] id = '"+request.querystring[id]+"' order id asc" >           </asp:sqldatasource> 

try instead:

<asp:sqldatasource id="dd_ai_ds" runat="server"     connectionstring="<%$ connectionstrings:myconnectionstring %>"     selectcommand="select distinct [myfield] [mytable] id = @id order id asc" >    <selectparameters>     <asp:querystringparameter name="id" querystringfield="post_id" type="string" />    </selectparameters> </asp:sqldatasource> 

as aside, if code had written had worked have created security hole in website allowing sql injection. read on topic don't accidentally make websites open hackers.


Comments

Popular posts from this blog

ios - UICollectionView Self Sizing Cells with Auto Layout -

node.js - ldapjs - write after end error -

DOM Manipulation in Wordpress (and elsewhere) using php -