c# - using QueryString in ASPX file -
i trying use sql command in aspx file capture querysring value having syntax issue. works fine when try filter querystring syntax issue. how can filter query using querystring? here code:
<asp:sqldatasource id="dd_ai_ds" runat="server" connectionstring="<%$ connectionstrings:myconnectionstring %>" selectcommand="select distinct [myfield] [mytable] id = '"+request.querystring[id]+"' order id asc" > </asp:sqldatasource>
try instead:
<asp:sqldatasource id="dd_ai_ds" runat="server" connectionstring="<%$ connectionstrings:myconnectionstring %>" selectcommand="select distinct [myfield] [mytable] id = @id order id asc" > <selectparameters> <asp:querystringparameter name="id" querystringfield="post_id" type="string" /> </selectparameters> </asp:sqldatasource>
as aside, if code had written had worked have created security hole in website allowing sql injection. read on topic don't accidentally make websites open hackers.
Comments
Post a Comment