You will have to create an object with the job of delivering SQL. The SQL
string will then be sent to the database from the object and run. Since you
are dealing with random FUD, you will likely have to return a Random
DataSet.

NOTE: This is not a good security practice, as anyone with a SQL background
can do major damage to your database with this wide open ability. You should
restrict the account that can run queries this way to only being able to
query tables that it should have access to and stop any security SQL or DDL
from running under this account.

I know this is an old thread, but in case anyone else stumbles across this trying to do it, there is a VERY easy way to do it.  You can create a SelectParameter that will be set to the dynamic SQL query you want to run.  Then in your data source, in the SelectMethod and Selectmethod calls, you need to add the extra parameter (first parameter actually).  In the SelectMethod, just use what is passed in.

In the SelectCount method (assuming a paged data source), you'll need to replace everything before the "FROM" clause with "SELECT COUNT(*) ".  That's it.

I did this so that bound controls I was using could set filter criteria easily or even pass a very complex where clause in the query referencing many things without needing lots of separate parameters for all the different columns or tables referenced, and so I also could easily drop out requested columns if I only want a subset.  Because the calling code uses reflection, it all works beautifully.

That said, i echo the caution about security vulnerability.  In my case, it is special code-behind code behind my controls that is crafting the query.  I do NOT recommend ever just passing whatever a user types in.

From http://www.developmentnow.com/g/8_2006_8_0_0_814203/Moving-SqlDataSource-to-Obje
ctDataSource-need-help.ht