Dynamically linked pages ASP.NET - asp.net

Question

I have created a Master page. And I have created a default page named default.aspx The defult aspx file has all of the standard content and ID's. In the ID I made a div tag to hold content for the dynamic page.
<%# Page Title="" Language="vb" AutoEventWireup="false" MasterPageFile="~/Site.Master" CodeBehind="Default.aspx.vb" Inherits="P03_S02.Link1" %>
<asp:Content ID="Content2" ContentPlaceHolderID="ContentPlaceHolder1" runat="server">
<div id="DynPage" runat="server"></div>
</asp:Content>
This is all good. So by using SQL server express that comes with Visual Studio 2012 I created a table with data in it. The entitys in the table is
ProductID
Name
Price
Quantity
Now in the default.aspx.vb page I completed the following code.
Imports System.Data
Imports System.Data.SqlClient
Public Class Catelog
Inherits System.Web.UI.Page
Protected Sub Page_Load(ByVal sender As Object, ByVal e As System.EventArgs) Handles Me.Load
If Not Page.IsPostBack Then
Dim Connection As SqlConnection
Dim Command As SqlCommand
Dim Reader As SqlDataReader
Connection = New SqlConnection("Data Source=(LocalDB)\v11.0;AttachDbFilename=|DataDirectory|\Products.mdf;Integrated Security=True")
Dim CommandString As String
CommandString = "SELECT * FROM Product"
Command = New SqlCommand(CommandString)
Command.CommandType = CommandType.Text
Command.Connection = Connection
Command.Connection.Open()
Command.ExecuteNonQuery()
Reader = Command.ExecuteReader(CommandBehavior.CloseConnection)
Dim ProductList As String
If Reader.HasRows Then
ProductList &= "<table width=""100%"">"
ProductList &= " <tr bgcolor=""#00CCFF"">"
ProductList &= "<td><b>ID</b></td>"
ProductList &= "<td><b>Product</b></td>"
ProductList &= "<td><b>Price</b></td>"
ProductList &= "<td><b>Quantity</b></td>"
ProductList &= "</tr>"
While Reader.Read
Dim newProduct As String
ProductList &= "<tr>"
ProductList &= "<td>" & Reader("ProductID") & "</td>" & _
"<td>" & "" & Reader("Name") & "" & "</td>" & _
"<td>" & Reader("Price") & "</td>" & _
"<td>" & Reader("Quantity") & "</td>"
ProductList &= "</tr>"
End While
ProductList &= "</table>"
End If
Catelog.InnerHtml = ProductList
Command.Connection.Close()
' Command.Dispose()
Connection.Dispose()
ProductCatelog.InnerHtml = ProductList
End If
End Sub
End Class
As you can see the table will display all data form the table. In the while loop I make each name in the table hyperlinks to another apsx file named Link1.
I used the same code as above but changed a few things in Link1.aspx.vb
Added:
Dim ProductID As String
ProductID = Request.QueryString("ProdID").ToString()'problem possible here
Changed the Display of data:
Dim ProductList As String
If Reader.HasRows Then
ProductList &= "<table width=""100%"">"
ProductList &= " <tr bgcolor=""#00CCFF"">"
ProductList &= "<td><b>Product</b></td>"
ProductList &= "<td><b>Price</b></td>"
ProductList &= "<td><b>Quantity</b></td>"
ProductList &= "</tr>"
While Reader.Read
Dim newProduct As String
ProductList &= "<tr>"
ProductList &= "<td>" & Reader("Name") & "</td>" & _
"<td>" & Reader("Price") & "</td>" & _
"<td>" & Reader("Quantity") & "</td>"
ProductList &= "</tr>"
End While
ProductList &= "</table>"
End If
Used the following to display only one record:
Dim CommandString As String
CommandString = "SELECT * FROM Product where ProductID =" & ProductID
My goal is if you click on a name it will link it to Link1.aspx and display only information about that name (Info in table). That does not happen because the program crashes. I have used all my basic debugging knowledge.

Answer 1

In default.aspx.vb you have :
"<td>" & "" & Reader("Name") & "" & "</td>" & _
passing name as ProdID
for ProdID you are passing Name and in link1.aspx.vb you are querying like:
Dim ProductID As String
ProductID = Request.QueryString("ProdID").ToString()'problem possible here
and later:
Dim CommandString As String
CommandString = "SELECT * FROM Product where ProductID =" & ProductID
expecting ProdID, not Name.
So, in default.aspx.vb you should change the line to:
<td>" & "<a href=""Link1.aspx?ProdID=""" & Reader("ProdID").ToString() & ">" &

Answer 2

Firstly, look up SqlParameters, because you've just opened your code up to SQL injection by passing parameters in the QueryString.
To address your question, I think the problem lies with this line:
"<td>" & "" & Reader("Name") & "" & "</td>" & _
You are closing your double-quote too soon and the productId isn't being put inside the href.
I'd rewrite it like this:
"<td>" & "" & Reader("Name") & "" & "</td>" & _
Subtle difference, but it should make it work.
Finally, always do a null/empty string check on the QueryString before you call .ToString(). Compare your QueryString entry using String.IsNullOrWhiteSpace(), and then only continue processing when String.IsNullOrWhiteSpace() returns false.