asp.net

是用来新手入门的，高手们不要见笑呀！
string conn = "server=.;database=login;user id=sa;pwd=123";
        SqlConnection cn = new SqlConnection(conn);
        cn.Open();
        string strsql = "select user_name,user_pwd from admin where user_name='" + TextBox1.Text + "' or user_pwd='" + TextBox2.Text + "'";
        SqlCommand cmd = new SqlCommand(strsql, cn);
        SqlDataReader rd = cmd.ExecuteReader();
        if (rd.Read())
        {
            if (rd.GetValue(0).ToString() == TextBox1.Text)
            {
                if (rd.GetValue(1).ToString() == TextBox2.Text)
                {
                    Response.Redirect("Default.aspx");
                }
                else
                {
                    Response.Write("<script>alert('密码错误！')</script>");
                }
            }
            else
            {
                Response.Write("<script>alert('用户名错误！')</script>");
            }
        }
        else
        {
            Response.Write("<script>alert('用户不存在！')</script>");
        }
    }