做用户身份验证 路上迷路

private void login_btn_Click(object sender, System.EventArgs e)
{
if (this.usename_text.Text == "" || this.pwd_text.Text == "")
{
Response.Write("<script defer>alert('请每项都输入！');</script>");
}
else
{
SqlConnection con=DB.Creat();
con.Open();
SqlCommand cmd=new SqlCommand("select usename,usepwd from uses where usename='"+this.usename_text.Text+"'and usepwd='"+this.pwd_text.Text+"',con");
SqlDataReader dr = cmd.ExecuteReader();

if(dr.Read) //或者用if(dr.HasRows)
//....
}