C# .NET - In Windows form application get answer which one is wrong if username,uname incorrect

Asked By lakshmi g on 08-Nov-13 01:30 PM
if (!(string.IsNullOrEmpty(textBox1.Text)) && !(string.IsNullOrEmpty(textBox2.Text)))
  {
  con.Open();
   cmd = new SqlCommand("select count(*) from login where uname='" + textBox1.Text + "' and pwd='" + textBox2.Text + "'", con);
   int count = Convert.ToInt32(cmd.ExecuteScalar());
  con.Close();
  if (count > 0)
  MessageBox.Show("Valid Username and Password"); // or go to the page
  else
  MessageBox.Show("Invalid Username or Password");
   }

If we enter uname,password if uname is incorrect shows uname is not correct.. All program in internet shows not valid uname or pwd.If password mismatch password is not valid
Robbe Morris replied to lakshmi g on 08-Nov-13 01:30 PM
You need to read up on the subject "SQL Injection Attacks" before a more senior person on your team looks at your code.  All those people you read about getting their database hacked wrote code just like this.  Don't be those people.