C# 如何将输入的证用户名和密码与数据库进行对比？

string s1 = "Server=127.0.0.1;Initial Catalog=User;user id=sa;password=123456";
protected void btn_denglu_Click(object sender, EventArgs e)
{
string s2 = "SELECT * FROM zhanghao WHERE ((username = '" + TextBox1.Text.Trim() + "') AND (password = '" + TextBox2.Text.Trim() + "'))";
SqlConnection scon = new SqlConnection(s1);
SqlCommand scmd = new SqlCommand(s2, scon);
scon.Open();
SqlDataReader sda = scmd.ExecuteReader();
if (sda.Read())
{
Response.Redirect("list.aspx");
}
else
{
if (TextBox1.Text.Trim() == "" | TextBox2.Text == "")
{
Response.Write("");
}
else
{
Response.Write("");
}
}
}