title: ASP.NET : Passing a outside variable into a <asp:sqldatasource> tag ASP.NET 2.0
body: <p>I'm designing some VB based ASP.NET 2.0, and I am trying to make more use of the various ASP tags that visual studio provides, rather than hand writing everything in the code-behind.  I want to pass in an outside variable from the Session to identify who the user is for the query.</p>
  
  <pre><code>&lt;asp:sqldatasource id="DataStores" runat="server" connectionstring="&lt;%$ ConnectionStrings:MY_CONNECTION %&gt;"
            providername="&lt;%$ ConnectionStrings:MY_CONNECTION.ProviderName %&gt;"
            selectcommand="SELECT THING1, THING2 FROM DATA_TABLE WHERE (THING2 IN (SELECT THING2 FROM RELATED_DATA_TABLE WHERE (USERNAME = @user)))"
            onselecting="Data_Stores_Selecting"&gt;
  
            &lt;SelectParameters&gt;
            &lt;asp:parameter name="user" defaultvalue ="" /&gt;
            &lt;/SelectParameters&gt;
  
            &lt;/asp:sqldatasource&gt;
  </code></pre>
  
  <p>And on my code behind I have:</p>
  
  <pre><code>Protected Sub Data_Stores_Selecting(ByVal sender As Object, ByVal e As System.Web.UI.WebControls.SqlDataSourceSelectingEventArgs) Handles Data_Stores.Selecting
  
      e.Command.Parameters("user").Value = Session("userid")
  End Sub
  </code></pre>
  
  <p>Oracle squaks at me with ORA-01036, illegal variable name.  Am I declaring the variable wrong in the query? </p>
  
  <p>I thought external variables share the same name with a @ prefixed.  from what I understand, this should be placing the value I want into the query when it executes the select.</p>
  
  <p>EDIT: Okay, thanks for the advice so far, first error was corrected, I need to use : and not @ for the variable declaration in the query.  Now it generates an ORA-01745 invalid host/bind variable name.</p>
  
  <p>EDIT AGAIN: Okay, looks like user was a reserved word.  It works now!  Thanks for other points of view on this one.  I hadn't thought of that approach.</p>