hi kingmaker,

If you are setting the SelectCommand then you can do this.
SqlDataSource1.SelectCommand = "SELECT * FROM [test.csv] WHERE " & ColumnName & " = " & searchCriteria
If you are using Stored procedure and columnname and searchcriteria as parameters, then you have to do
DECLARE @SQLQUERY VARCHAR(1000)

SET @SQLQUERY = N'SELECT * FROM TABLE1 WHERE ' + QUOTENAME(@COLUMNNAME) + ' = ' + @SearchCriteria

EXEC (@SQLQUERY)
In the above QuoteName is used to thwart Sql injection.

__________________
Venkat
knowledge is Power