sqldatasource select command didn't work - asp.net

Question

I have a problem doing search in asp.net, when I try to run the code in sqlserver or using query buider it works fine. But when I run the program in browser, the gridview didn't even show up. Help plz.
protected void btnsearchadvance_Click(object sender, EventArgs e)
{
if (txtname.Text.Trim() != "")
{
search = "NmBengkel LIKE '%" + txtname.Text + "%'";
}
if (txtaddress.Text.Trim() != "")
{
search = search + " AND Address LIKE '%" + txtaddress.Text + "%'";
}
if (txttelp.Text.Trim() != "")
{
search = search + " AND NoTelp LIKE '%" + txttelp.Text + "%'";
}
if (txtnote.Text.Trim() != "")
{
search = search + " AND Note LIKE '%" + txtnote.Text + "%'";
}
SqlDataSource1.SelectCommand = "SELECT * FROM mst_bengkel where " + search;
}

Answer 1

you can use parameterized Query like
_cmd = new SqlCommand();
_cmd.CommandText = "prc_GetSampleData";
_cmd.CommandType = CommandType.StoredProcedure;
_cmd.Parameters.Add("#name", SqlDbType.Varchar).Value = txtname.Text.Trim();
_cmd.Parameters.Add("#address", SqlDbType.Decimal).Value = txtaddress.Text.Trim();
_cmd.Parameters.Add("#telp", SqlDbType.Decimal).Value = txttelp.Text.Trim();
_cmd.Parameters.Add("#note", SqlDbType.Decimal).Value = txtnote.Text.Trim();
_cmd.Connection = _con;
_con.Open();
try
{
sqlDA = new SqlDataAdapter(sqlCmd);
sqlDA.Fill(ds, "SampleData");
}
catch (Exception ex) { _ex = ex; }
finally { if (_con.State == ConnectionState.Open) { _con.Close(); } }
Here is the procedure
Create procedure prc_GetSampleData
#name varchar(50) =null,
#address varchar(50)=null,
#telp varchar(50)=null,
#note varchar(50)=null
AS
BEGIN
Declare #prmname varchar(50)='%%'
Declare #prmaddress varchar(50)='%%'
Declare #prmtelp varchar(50)='%%'
Declare #prmnote varchar(50)='%%'
if #name is not null
begin
set #prmname=#name
end
if #address is not null
begin
set #prmaddress=#address
end
if #telp is not null
begin
set #prmtelp=#telp
end
if #note is not null
begin
set #prmnote=#note
end
SELECT * FROM mst_bengkel where name Like #prmname and address like #prmaddress and telp like #prmtelp and note like #prmnote
END

Answer 2

Use stored procedure.
using System.Data;
using System.Data.SqlClient;
#region Declaration
private SqlConnection _con;
private SqlCommand _cmd;
private SqlDataAdapter _sda;
private Exception _ex;
private SqlDataReader _sdr;
#endregion
protected void btnsearchadvance_Click(object sender, EventArgs e)
{
_con = new SqlConnection(ConfigurationManager.AppSettings["connectionstring"].ToString());
_cmd = new SqlCommand();
_cmd.CommandText = "prc_GetSampleData";
_cmd.CommandType = CommandType.StoredProcedure;
_cmd.Parameters.Add("#name", SqlDbType.Varchar).Value = txtname.Text.Trim();
_cmd.Parameters.Add("#address", SqlDbType.Decimal).Value = txtaddress.Text.Trim();
_cmd.Parameters.Add("#telp", SqlDbType.Decimal).Value = txttelp.Text.Trim();
_cmd.Parameters.Add("#note", SqlDbType.Decimal).Value = txtnote.Text.Trim();
_cmd.Connection = _con;
_con.Open();
try
{
_sda = new SqlDataAdapter(_cmd);
_sda.Fill(ds, "SampleData");
}
catch (Exception ex) { _ex = ex; }
finally { if (_con.State == ConnectionState.Open) { _con.Close(); } }
}