The if condition is only checking for null or empty, this wouldn't fix the flaw. 
I want to check whether the Year string contains a number.
string Year = Request.Params[""year""];
if (Year == null || Year.Equals(""""))    
{    
    Year = System.DateTime.Now.Year.ToString();    
}
