asp.net - Using user.identity.Name in SQL statement -

in asp.net app, have following sql works:

<asp:sqldatasource id="isesdatabase" runat="server" connectionstring="<%$ connectionstrings:connectionstring %>" selectcommand="select [id], [word], [definition], [example] [griddata] [strategy]='vocabulary'"> 

however, need add user id check clause, , hoping use user.identity.name perform check. have tried following, doesn't work:

<asp:sqldatasource id="isesdatabase" runat="server" connectionstring="<%$ connectionstrings:connectionstring %>" selectcommand="select [id], [word], [definition], [example] [griddata] [userid]= /'" + user.identity.name + "/' , [strategy]='vocabulary'"> 

here error:

parser error description: error occurred during parsing of resource required service request. please review following specific parse error details , modify source file appropriately.

parser error message: server tag not formed.

source error:

line 46:             <asp:sqldatasource id="isesdatabase" runat="server" connectionstring="<%$ connectionstrings:connectionstring %>" selectcommand="select [id], [word], [definition], [example] [griddata] [userid]=/'" + user.identity.name + "/' , [strategy]='vocabulary'"> 

what doing wrong?

i think need rethink approach. rather trying 'hard-code' 'user.identity.name' property in asp:sqldatasource element, try creating parameter hold value:

1) replace 'user.identity.name' in selectcommand token parameter, such '@name'.

2) define selectparameter element asp:sqldatasource has name property of 'name'. set type property of parameter whatever data type of 'user.identity.name'.

3) then, can define value want select programmatically in event handler selecting event of sqldatasource.

here's example works. following code snippet aspx page:

<asp:gridview id="mygridview" runat="server" datasourceid="mydatasource" datakeynames="id"></asp:gridview> <asp:sqldatasource id="mydatasource" runat="server"     selectcommand="select * [users] [name] = @name"     connectionstring='data source=(localdb)\v11.0;attachdbfilename="c:\users\windowslogin\documents\visual studio 2012\projects\webapplication1\webapplication1\app_data\database1.mdf";integrated security=true'>     <selectparameters>         <asp:parameter name="name" type="int32" />     </selectparameters> </asp:sqldatasource> 

then, in code-behind, can define parameter programmatically @ run-time based on whatever criteria matter. (here, i'm assigning value '2' @name parameter; replace 'user.identity.name'.)

private sub mydatasource_selecting(sender object, e sqldatasourceselectingeventargs) handles mydatasource.selecting     e.command.parameters("@name").value = 2 end sub 

i hope clear... if not, refer documentation on msdn. here couple of pages started:

sqldatasource.selectcommand property

sqldatasourceselectingeventargs class

and, more generally,

using parameters data source controls filtering