asp.net中怎么验证登陆名和密码 小弟我的数据库是sql server 2005 请指点下 多谢

string username = "";  //用户名string password = "";  //密码using (SqlConnection conn = new SqlConnection(@"Data Source=服务器;Initial Catalog=数据库;User ID=数据用户名;Password=数据库密码;")){    if (conn.State == ConnectionState.Closed)    {        conn.Open();    }    using (SqlCommand comm = conn.CreateCommand())    {        comm.CommandText = " SELECT Password FROM [USER] WHERE USERNAME='" + username + "'";        using (SqlDataReader dr = comm.ExecuteReader())        {            if (!dr.HasRows)            {                 //此时不存在该用户名 即用户名出错                return;            }            dr.Read();            string rpwd = dr[0].ToString();            if (rpwd != password)            {                 //此时密码输入不正确                return;            }            //            // 验证通过操作            //        }    }}
------解决方案--------------------------------------------------------
C# code
public  AdminList GetAdminInfo(string name,string pwd)        {            Open();                string sql = string.Format("select userName,passWord from adminList where userName='{0}' and  passWord='{1}'", name, pwd);                SqlCommand commadn = new SqlCommand(sql,Connection);                SqlDataReader read = commadn.ExecuteReader();                //判断是否有数据                if (read.HasRows)                {                    while (read.Read())                    {                        user.UserName = read["userName"].ToString();                        user.UserPwd = read["userPwd"].ToString();                    }                                    }                else                {                    //没有数据则添加空信息                    user.UserName = "";                    user.UserPwd = "";                }                Connection.Close();            return user;        }