Searching from a form

A search box turns a list into a tool. The visitor types a term and the grid narrows to matches.

Add a parameter to the data source

<asp:SqlDataSource id="productsSource" runat="server"
    ConnectionString="<%$ ConnectionStrings:Shop %>"
    SelectCommand="SELECT Id, Name FROM Product WHERE Name LIKE @term">
    <SelectParameters>
        <asp:ControlParameter Name="term" ControlID="txtSearch"
            PropertyName="Text" DefaultValue="%" />
    </SelectParameters>
</asp:SqlDataSource>

Points worth noting

• The parameter is filled from a control, so no string building is needed.
• A default value keeps the grid sensible before the visitor types anything.
• The query still runs as a parameterised command, which is the safe approach.

When the visitor needs to add data rather than find it, move to inserting a row from a form.