运行时说语句 SqlCommand com1=new SqlCommand (strsql,conn);附近有异常_ASP.NET

运行时说语句 SqlCommand com1=new SqlCommand (strsql,conn);附近有错误
using System;
using System.Collections;
using System.ComponentModel;
using System.Data;
using System.Drawing;
using System.Web;
using System.Web.SessionState;
using System.Web.UI;
using System.Web.UI.WebControls;
using System.Web.UI.HtmlControls;
using System.Data.SqlClient;
namespace user_manger
{
/// <summary>
/// WebForm8 的摘要说明。
/// </summary>
public partial class WebForm8 : System.Web.UI.Page
{
protected SqlConnection conn;
protected SqlCommand com1;

protected void Page_Load(object sender, System.EventArgs e)
{
conn=new SqlConnection();
conn=new SqlConnection("Server=.;Database=user_manger;uid=sa;pwd=");
conn.Open();
string strsql = "select * from user1 where user_id=" + Request["id"];
//string strsql="select * from user1 where user_id=@id";
SqlCommand com1=new SqlCommand (strsql,conn);
SqlDataReader dr=com1.ExecuteReader ();
string html="<Table border=1>";
html+="<tr>";
html+="<tr>";
html+=" ";
html+=" ";
html+=" ";
html+=" ";
html+=" ";html+=" ";html+=" ";html+=" ";html+=" ";html+=" ";html+=" ";html+=" ";

html+="<td>编号</td>";
html+="<td>姓名</td>";
html+="<td>出生日期</td>";
html+="<td>提示问题</td>";
html+="<td>答案</td>";
html+="<td>工作</td>";
html+="<td>电子邮件</td>";
html+="</tr>";
try
{
while(dr.Read ())
{
html+="<tr>";
html+="<td>"+dr["user_id"].ToString()+"</td>";
html+="<td>"+dr["user_name"].ToString()+"</td>";
html+="<td>"+dr["user_brithday"].ToString()+"</td>";
html+="<td>"+dr["user_ask"].ToString()+"</td>";
html+="<td>"+dr["user_answer"].ToString()+"</td>";
html+="<td>"+dr["user_work"].ToString()+"</td>";
html+="<td>"+dr["user_email"].ToString()+"</td>";
html+="</tr>";
}
html+="</Table>";
}
finally
{
dr.Close ();
conn.Close ();

}
Response.Write (html);
// 在此处放置用户代码以初始化页面
}

#region Web 窗体设计器生成的代码
override protected void OnInit(EventArgs e)
{
//
// CODEGEN: 该调用是 ASP.NET Web 窗体设计器所必需的。
//
InitializeComponent();
base.OnInit(e);
}

/// <summary>
/// 设计器支持所需的方法 - 不要使用代码编辑器修改
/// 此方法的内容。
/// </summary>
private void InitializeComponent()
{

}
#endregion
}
}

------解决方案--------------------------------------------------------
改成

conn.Open();
string strsql="select * from user1 where user_id=@id";
SqlCommand com1=new SqlCommand (strsql,conn);
com1.Paramters.AddWithValue("@id",Request["id"].Trim());