Using Parameters with the SqlDataSource Control

When using the SqlDataSource control, you can specify SQL queries and statements that use parameters. This helps make your data-binding scenarios more flexible by
reading and writing database information based on values




how to Specifying Parameters in Commands
When you use the SqlDataSource control, you can set the control's command properties to parameterized SQL statements or to the name of a stored procedure.
The SqlDataSource control adds the value of the ParameterPrefix property to the beginning of all parameter names. (The default prefix is "@".)


Using Parameters with the SqlClient Provider:
By default, the SqlDataSource control uses the System.Data.SqlClient data provider to work with SQL Server as the data source. The System.Data.SqlClient provider supports named parameters as placeholders, as shown in the following example:


SELECT * FROM Stud WHERE Rollno = @Rno
AND Name = @Name


The following example shows how to use parameters in an SQL command for a SqlDataSource control that uses the System.Data.SqlClient provider

[C# code]

<asp:sqlDataSource ID="StudInfo"
SelectCommand="SELECT Marks,Rollno,ID FROM Stud WHERE Rollno = @Rno"
ConnectionString="<%$ ConnectionStrings:Stud %>" RunAt="server">
<SelectParameters>
<asp:Parameter Name="Rno" Type="Int32" DefaultValue="0" />
</SelectParameters>

//Suppose for insert query
<InsertParameters>
<asp:Parameter Name="abc" Type="String" />
<asp:Parameter Name="xyz" Type="String" />
</InsertParameters>

// for update
<UpdateParameters>
<asp:Parameter Name="abc" Type="String" />
</UpdateParameters>

//you can also use Seesion Parameter

<SelectParameters>
<asp:SessionParameter
Name="Rollno"
SessionField="Rno"
DefaultValue="1" />
</SelectParameters>

// also pass via querystring
<SelectParameters>

<asp:QueryStringParameter Name="Rollno" QueryStringField="rno" Type="int" />

</SelectParameters>


like this u can access Parameters with the SqlDataSource Control
also refer This Article