VB.NET executeScalar IF有条件

Question

Call con_getsetting()
    If con_open() = True Then
        Dim pass As String
        Using cmd As New SqlCommand("select pass_key from m_user where user_id='" + TextBox1.Text.Replace("'", "").Replace("--", "") + "'", con)
            pass = cmd.ExecuteScalar
            If pass <> Nothing Then
                If pass = TextBox2.Text Then
                    MessageBox.Show("Login Success!!, Go To Main Menu!", "DJIESOFT", MessageBoxButtons.OK, MessageBoxIcon.Information)
                    Me.Close()
                Else
                    counter += 1
                    If counter <> 3 Then
                        MessageBox.Show("Invalid Password")
                    Else
                        MessageBox.Show("Invalid Password" & vbNewLine & "Anda Sudah 3X Gagal melakukan Login!")
                        Me.Close()
                    End If
                End If
            Else
                counter += 1
                If counter <> 3 Then
                    MessageBox.Show("Invalid User ID")
                Else
                    MessageBox.Show("Invalid User ID" & vbNewLine & "Anda Sudah 3X Gagal melakukan Login!")
                    Me.Close()
                End If

            End If
        End Using
    End If

当我输入现有数据时，显示“密码无效”？抱歉我的英语不好。你知道如何使用SQL SERVER安全登录，语言是VB.NET吗？