ASPÁ´½ÓSQLµÄ¼òµ¥µÇ½½çÃæ - .NET¼¼Êõ / ASP.NET

protected void btnLogin_Click(object sender, EventArgs e)
  {

  SqlConnection conn = new SqlConnection("Server = (local);user id = sa;pwd = 1;database = Login");
  try
  {
  conn.Open();
  string cmdText = "select username from userinfo where username = '" + this.txtUsername.Text.Trim() + "' and userpassword='" + this.txtPassword.Text.Trim() + "'";



  SqlDataAdapter sqlCommon = new SqlDataAdapter(cmdText, conn);
  DataSet ds = new DataSet();
   
  sqlCommon.Fill(ds);
  if (txtUsername.Text.Trim() == ds.Tables[0].Rows[0][" username"] && txtPassword.Text.Trim() == ds.Tables[0].Rows[0]["userpassword"])

  {
  conn.Close();
  Response.Redirect("Default2.aspx");
   
  }
  else
  {
  lblResults.Visible = true;
  lblResults.Text = "Óû§Ãû»òÃÜÂë´íÎó£¡";
  txtUsername.Text = "";
  txtPassword.Text = "";

  }
  conn.Close();