hi there. i need some help with a query please. my table has two
fields:

family_id {identity} - uniqueidentifier

family_name - nvarchar

I have a query in my ASP.NET code (in VB.NET) that should compare a
family_id as supplied by the user as a string with the family_id in
the table and output the corresponding family_name.

My query is as follows:

Dim UserID As String = New
String(Membership.GetUser(User.Identity.Name).Prov iderUserKey.ToString())

Dim queryString As String = "SELECT family_name FROM tblFamily WHERE '
& [family_id] & ' = ' & UserID & ' ;"

The problem is, that whenever I execute this, it never returns
anything.

Thanks in advance for any help you can give me.

The best solution to this problem is to use a parameterized query. See one example here (in the Parameterization section):
http://pratchev.blogspot.com/2009/03/sql-injection.html

To use the code as you have it you can enclose the value in single quotes:

Dim queryString As String = "SELECT family_name FROM tblFamily WHERE family_id = '" & UserID & "';"


--
Plamen Ratchev
http://www.SQLStudio.com