html - The Server Tag is Not Well Formed - SQL Query -

i have been trying aspx page change sql query's order depending on html page's form. keeps giving me "parser error message: server tag not formed." how can fix code below?

    <%      dim sortingorder = request.querystring("sortorder") %> <form id="form1" runat="server">     <asp:gridview id="gridview1" runat="server" autogeneratecolumns="false" datakeynames="id" datasourceid="sqldatasource1" emptydatatext="there no data records display.">         <columns>             <asp:boundfield datafield="id" headertext="id" readonly="true" sortexpression="id" />             <asp:boundfield datafield="title" headertext="title" sortexpression="title" />             <asp:boundfield datafield="summary" headertext="summary" sortexpression="summary" />             <asp:boundfield datafield="body" headertext="body" sortexpression="body" />             <asp:boundfield datafield="genreid" headertext="genreid" sortexpression="genreid" />             <asp:checkboxfield datafield="authorized" headertext="authorized" sortexpression="authorized" />             <asp:boundfield datafield="createdatetime" headertext="createdatetime" sortexpression="createdatetime" />             <asp:boundfield datafield="updatedatetime" headertext="updatedatetime" sortexpression="updatedatetime" />         </columns>     </asp:gridview>     <asp:sqldatasource id="sqldatasource1" runat="server" connectionstring="<%$ connectionstrings:planetwrox.mdfconnectionstring1 %>" deletecommand="delete [review] [id] = @id" insertcommand="insert [review] ([title], [summary], [body], [genreid], [authorized], [createdatetime], [updatedatetime]) values (@title, @summary, @body, @genreid, @authorized, @createdatetime, @updatedatetime)" providername="<%$ connectionstrings:planetwrox.mdfconnectionstring1.providername %>" selectcommand="select [id], [title], [summary], [body], [genreid], [authorized], [createdatetime], [updatedatetime] [review] order request.querystring("sortorder")" updatecommand="update [review] set [title] = @title, [summary] = @summary, [body] = @body, [genreid] = @genreid, [authorized] = @authorized, [createdatetime] = @createdatetime, [updatedatetime] = @updatedatetime [id] = @id">         <deleteparameters>             <asp:parameter name="id" type="int32" />         </deleteparameters>         <insertparameters>             <asp:parameter name="title" type="string" />             <asp:parameter name="summary" type="string" />             <asp:parameter name="body" type="string" />             <asp:parameter name="genreid" type="int32" />             <asp:parameter name="authorized" type="boolean" />             <asp:parameter name="createdatetime" type="datetime" />             <asp:parameter name="updatedatetime" type="datetime" />         </insertparameters>         <updateparameters>             <asp:parameter name="title" type="string" />             <asp:parameter name="summary" type="string" />             <asp:parameter name="body" type="string" />             <asp:parameter name="genreid" type="int32" />             <asp:parameter name="authorized" type="boolean" />             <asp:parameter name="createdatetime" type="datetime" />             <asp:parameter name="updatedatetime" type="datetime" />             <asp:parameter name="id" type="int32" />         </updateparameters>     </asp:sqldatasource>     <asp:commandfield showdeletebutton="true" showeditbutton="true"         showselectbutton="true" buttontype="button"></asp:commandfield>     <asp:database.query(select * review [order by<% response.write(request.querystring("sortorder"))%>])></asp:database.query>     </form> 

your problem here:

selectcommand="select [id], [title], [summary], [body], [genreid], [authorized], [createdatetime], [updatedatetime] [review] order request.querystring("sortorder")" 

the double quotes in request.querystring("sortorder")" closing tag prematurely. , can't use query string directly.

should this:

selectcommand="select employeeid, lastname employees employeeid = @empid">     <selectparameters>       <asp:querystringparameter     name="empid" querystringfield="empid" />     </selectparameters> 

taken page:

http://msdn.microsoft.com/en-us/library/system.web.ui.webcontrols.querystringparameter.querystringfield.aspx