Help with Sql parameters...

I'm having some problems getting this to work so I took out what I had been attempting to see if you all had any suggestions. So what I am trying to do is on the login page I am putting a client's name in a session variable. Once I get redirected to the Default.aspx page I want to use that information to display files from a database but only those files that the specific client should see. I have most of it working fine. The problem is I haven't been able to figure out how to pass the session object to the sql query and have it use that in the WHERE statement...Here is the code I am working with. namespace LandFormFileProject.UploadAccess { public class Default : Generic { public string CmdText = "SELECT ID, FileName, FileSize, " + "ContentType FROM Files"; protected System.Web.UI.WebControls.Label Label1; protected System.Web.UI.WebControls.Label Label2; protected HtmlGenericControl allFiles; public void Page_Load(object sender, System.EventArgs e) { allFiles.InnerHtml = GetFilesFromAccessDb(); string client = (String)Session["clientLogon"]; //I know this does not go here. } private string GetFilesFromAccessDb() { StringBuilder buffer = new StringBuilder(1024); buffer.Append(""); buffer.Append(""); buffer.Append(""); buffer.Append(""); using(OleDbConnection con = new OleDbConnection(ConnectionString)) using(OleDbCommand cmd = new OleDbCommand(CmdText, con)) { con.Open(); OleDbDataReader rd = cmd.ExecuteReader(CommandBehavior.SingleResult | CommandBehavior.CloseConnection); while(rd.Read()) { int fileId; string fileName; int fileLength; string contentType; fileId = rd.GetInt32(0); fileName = rd.GetString(1); fileLength = rd.GetInt32(2); contentType = rd.GetString(3); buffer.Append(""); } rd.Close(); buffer.Append("

Name	Size	Content Type"); buffer.Append("
"); buffer.Append(fileName); buffer.Append(" [ Del ]"); buffer.Append(" [ Dnld ]"); buffer.Append("	"); buffer.Append(fileLength); buffer.Append("	"); buffer.Append(contentType); buffer.Append("

"); } return buffer.ToString(); } #region Web Form Designer generated code override protected void OnInit(EventArgs e) { // // CODEGEN: This call is required by the ASP.NET Web Form Designer. // InitializeComponent(); base.OnInit(e); } ///

/// Required method for Designer support - do not modify /// the contents of this method with the code editor. ///

private void InitializeComponent() { this.Load += new System.EventHandler(this.Page_Load); } #endregion } }