使用数据库中的登录代码时出错

Question

已经定义了上面的所有连接和命令对象..

SqlCommand cmd = new SqlCommand("select COUNT(*) FROM User where username='"+txtUsername .Text +"'and password='"+txtPassword .Text +"'", con);

Here is my Code

SqlDataAdapter da = new SqlDataAdapter(cmd);

DataTable dt = new DataTable;
da.Fill(dt);

if (dt.Rows.Count > 0)
{
    Response.Write("logged In");
}
else
{
    Response.Write("<script>alert('Please enter valid Username and Password');</script>");
}