帮忙看看,该怎么解决

 protected void Button1_Click(object sender, EventArgs e)    {        try        {            cn = new SqlConnection(System.Configuration.ConfigurationManager.ConnectionStrings["CoalLogiMConnectionString"].ConnectionString);            cn.Open();            SqlCommand sc = new SqlCommand("select stuffNum,password, zone,depart,position from userInfo where stuffNum='" + TextBox1.Text + "' and password='" + TextBox2.Text + "'", cn);            da = sc.ExecuteReader();            da.Read();            Session["stuffNum"] = da.GetValue(0).ToString();            Session["password"] = da.GetValue(1).ToString();            Session["zone"] = da.GetValue(2).ToString();            Session["depart"] = da.GetValue(3).ToString();            Session["position"] = da.GetValue(4).ToString();            if (TextBox1.Text != "" && TextBox2.Text != "")            {                if (TextBox1.Text.ToString() == Session["stuffNum"].ToString() && TextBox2.Text.ToString() == Session["password"].ToString())                {                    Response.Redirect("Main.aspx");                }                else                {                    Response.Write("<script language=javascript>alert('您输入的账号或者密码有误');'</script>");                }            }            else            {                Response.Redirect("Login.aspx");            }            da.Close();        }        finally        {            cn.Close();        }    }