验证用户名与密码是否匹配(c#)

楼主，你好：你可以设置这样的sql语句:
string cmdstr="select * from user where username='"+TextBox1.text+"' and userpassword='"+TextBox2.text+"'"
这是提取数据库里的user表里的用户名和密码的

private void button1_Click(object sender, EventArgs e)
{
string username = textBox1.Text;
string password = textBox2.Text;
try
{
SqlConnection con = new SqlConnection("server=localhost; uid=sa; pwd=123; database=mydb");
SqlCommand myCommand = new SqlCommand
string str = "select * from register where stuusername = '" + username + "' and stupassword = '"+password+ "'";
con.CommandText = str;
con.Connection = sqlcon;
//SqlCommand cmd = new SqlCommand(str, sqlcon);
SqlDataReader dr = sqlcom .ExecuteReader();
if (dr.Read ())
{
string stuusername = dr["stuusername"].ToString ().Trim ();
if (stuusername == username )