.NET语句这哪错了？怎么不能更改？

Dim conn As SqlConnection = New SqlConnection("database=new;uid=sa;pwd=;server=127.0.0.1")
Dim sqlstr As String = "select * from usertable where where username=" & Session("username") & "and userpsd='" & userpsd.Text & "'"
Dim da As New SqlDataAdapter(sqlstr, conn)
conn.Open()
Dim ds As New DataSet
da.Fill(ds, "usertable")
If ds.Tables("usertable").Rows.Count = 0 Then
Response.Write("<script>alert('原密码输入不正确！')</script>")
Else

Dim comm As New SqlCommand("Update usertable Set userpsd='" & userpsd1.Text & " ' where username ='" & Session("username") & "' ", conn)
comm.ExecuteNonQuery()
Response.Write("<script>alert('修改成功！')</script>")
End If
conn.Close()