Dynamic SelectCommand that Changes View based on DDL - asp.net

Question

Here's a dropdown list I have...
<asp:DropDownList
ID="selectTimeFrame"
runat="server"
AutoPostBack="true"
DataTextField="Increment"
DataValueField="Increment"
DataSourceID="SqlTimeFrame"
</asp:DropDownList>
And its datasource:
<asp:SqlDataSource
ID="SqlTimeFrame"
runat="server"
ConnectionString="<% connectionstring %>"
SelectCommand="Select [IncrementID], [Increment] FROM [TimeFrame] ORDER BY [IncrementID]" >
</asp:SqlDataSource>
and then I have a gridview, whos datasource looks like:
<asp:SqlDataSource ID="SqlDataSource2" runat="server" ConnectionString="<% connectinstring %>"
ProviderName="<% connectionstring %>"
SelectCommand="SELECT * FROM #TimeFrame">
<SelectParameters>
<asp:ControlParameter ControlID="selectTimeFrame"
Name="TimeFrame"
PropertyName="SelectedValue"
Type="String" />
</SelectParameters>
And obviously the place where I'm having problems is the fact that " FROM #TimeFrame " doesn't do what I want to. I have Different views whose names correspond to different timeframes, and I want to be able to change the gridview to populate with that information based off of the option a user selects via the dropdown menu. Any insight would be much appreciated... THANKS!! :D

Answer 1

You could use dynamic SQL to achieve what you're looking for although you would need to test this very thorughly to prevent SQL injection attacks as we can never trust the input being received from users.
I've created a simple stored proc which checks whether the table exists in the db and if so it constructs and executes your dynamic SQL statement:
Stored procedure:
CREATE PROCEDURE dbo.GetData
#TableName NVARCHAR(200)
AS
BEGIN
IF OBJECT_ID(#TableName , N'U') IS NOT NULL
BEGIN
EXEC('SELECT * FROM ' + #TableName);
END
END
ASPX:
<asp:DropDownList ID="selectTimeFrame" runat="server" AutoPostBack="true" DataTextField="Increment"
DataValueField="Increment" DataSourceID="SqlTimeFrame" />
<asp:SqlDataSource ID="SqlTimeFrame" runat="server" ConnectionString="<%$ ConnectionStrings:connectionstring %>"
SelectCommand="Select [IncrementID], [Increment] FROM [TimeFrame] ORDER BY [IncrementID]">
</asp:SqlDataSource>
<asp:SqlDataSource ID="dynamicDS" runat="server" ConnectionString="<%$ ConnectionStrings:connectionstring %>"
SelectCommand="GetData" SelectCommandType="StoredProcedure">
<SelectParameters>
<asp:ControlParameter ControlID="selectTimeFrame" Name="TableName" PropertyName="SelectedValue"
Type="String" />
</SelectParameters>
</asp:SqlDataSource>
<asp:GridView ID="gvData" DataSourceID="dynamicDS" runat="server">
</asp:GridView>