How to pass dynamic value in SqlDataSource?

Question

I need to pass this value Request.QueryString in my asp:SqlDataSource?

 <asp:SqlDataSource runat="server" 
                    ID="SqlDataSource2" ConnectionString='<%$ ConnectionStrings:messageexchangeConnectionString %>' 
                    ProviderName='<%$ ConnectionStrings:messageexchangeConnectionString.ProviderName %>' 
                    SelectCommand='SELECT distribution_address FROM exchange_distribution_groups ex WHERE (organisation_id = 'Request.QueryString["organisation"]') AND (distribution_address NOT IN (SELECT distribution_address FROM exchange_distribution_group_addresses address))'>     
 </asp:SqlDataSource>

That SelectCommand appears extremely susceptible to Sql Injection Attacks. — Erik Philips
– Erik Philips, Commented Sep 6, 2013 at 9:21

Samiey Mehdi · Accepted Answer · 2013-09-06 10:26:10Z

2

Try this:

<asp:SqlDataSource ID="SqlDataSource2" runat="server" 
    ConnectionString="<%$ ConnectionStrings:messageexchangeConnectionString %>" 
    SelectCommand="SELECT organisation_id,distribution_address FROM exchange_distribution_groups ex WHERE (([organisation_id] = @id) AND (distribution_address NOT IN (SELECT distribution_address FROM exchange_distribution_group_addresses address))">
    <SelectParameters>
        <asp:QueryStringParameter Name="id" QueryStringField="organisation" Type="Int32" />
    </SelectParameters>
</asp:SqlDataSource>

edited Sep 6, 2013 at 10:26

answered Sep 6, 2013 at 9:29

Samiey Mehdi

9,49419 gold badges51 silver badges65 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Ismail Saifo Over a year ago

Thanks for your help :) but it return nothing !! i think it is not take the value of organiasation !!!

Bibhu · Accepted Answer · 2013-09-06 09:20:58Z

2

You can use this

     <asp:SqlDataSource runat="server" ID="SqlDataSource2"
         ConnectionString='<%$ ConnectionStrings:messageexchangeConnectionString %>'
         ProviderName='<%$ ConnectionStrings:messageexchangeConnectionString.ProviderName %>'
         SelectCommand='SELECT distribution_address FROM exchange_distribution_groups ex WHERE (organisation_id = '<%# Request.QueryString["organisation"] %> ') AND (distribution_address NOT IN (SELECT distribution_address FROM exchange_distribution_group_addresses address))'>    
     </asp:SqlDataSource>

answered Sep 6, 2013 at 9:20

Bibhu

4,1014 gold badges35 silver badges64 bronze badges

3 Comments

Ismail Saifo Over a year ago

thanks for your help , i think i am getting there but i have this error: Parser Error Description: An error occurred during the parsing of a resource required to service this request. Please review the following specific parse error details and modify your source file appropriately. Parser Error Message: The server tag is not well formed.

Bibhu Over a year ago

@Ismail Saifo - "The server tag is not well formed" is raised if the asp.net tags are not complete and donot follow the specified format. I believe that its with the SqlDataSource tag. Check it once

Ismail Saifo Over a year ago

I did that But when I put : <%# Request.QueryString["mailbox"] %> i get the error :(

Collectives™ on Stack Overflow

How to pass dynamic value in SqlDataSource?

2 Answers 2

1 Comment

3 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

1 Comment

3 Comments

Your Answer

Sign up or log in

Post as a guest

Related