c# - Using a string variable in an ASPX SqlDataSource SelectCommand, is this possible? -

i know possible in codebehind, changing selectcommand there , binding causes gridview issues refreshing , sorting, not answer i'm looking for.

i incorporate parameterized statements sql params, need other parts of query change don't think work parameterized statements.

example:

<asp:sqldatasource id="sqlsolutionsource" runat="server"   selectcommand="select id, my_cat1, my_cat2, my_cat3, my_cat4, my_cat5, my_cat6 [my_db].[dbo].[my_table]"   connectionstring="<%$ connectionstrings:connectionstring %>" />  

i'll have 10 if else statements use "select id, my_cat1, my_cat2, my_cat3, my_cat4, my_cat5, my_cat6" portion of command.

if codebehind, create variable above string , change selectcommand "" + my_string + " [my_db].[dbo].[my_table]";

is there way on aspx page? i've tried creating public strings , using selectcommand="<%= my_string %> [my_db].[dbo].[my_table]" doesn't seem work @ all.

i understand people may wonder security implications , sql injections, variable hard coded , not allowed change user. want simplify commands , clean code, if need change selected items, have in 1 variable, not 10 different places.

ultimately, able build dynamic sql query selectcommand works quite well, using execute sp_executesql.

edit: added sample below.

sample code (untested, may need tweaking, production code different)

  <asp:sqldatasource id="sqlsolutionsource" runat="server"          selectcommand="         declare @perm_source varchar(30)         set @perm_source = @perm_type          declare @select_query nvarchar(400)             set @select_query = 'select id, my_cat1, my_cat2, my_cat3, my_cat4, my_cat5, my_cat6 ' + @perm_source         execute sp_executesql @select_query          "         connectionstring="<%$ connectionstrings:connectionstring %>" />  

now may argue ' + @perm_source susceptible injection attacks, in case not, variable (@perm_type) parameterized , based on static values codebehind.