parameters的问题，谁是高手？谁？现身……

protected void btnok_Click(object sender, EventArgs e)
    {
        SqlConnection conn = new SqlConnection(ConfigurationManager.AppSettings["ConStr"]);
     
        SqlCommand comm = new SqlCommand("select * from tb_User where Username=@loginName and Userpwd=@Pwd and Auditing=1", conn);
        comm.Parameters.Add(new SqlParameter("@loginName", SqlDbType.NVarChar, 50));
        comm.Parameters["@loginName"].Value = this.txtuser.ToString().Trim();
        comm.Parameters.Add(new SqlParameter("@Pwd", SqlDbType.NVarChar, 50));
        comm.Parameters["@Pwd"].Value = this.txtpwd.ToString().Trim();
        comm.Connection.Open();
        SqlDataReader dr = comm.ExecuteReader();
        if (dr.Read())
        {
            Session["username"] = dr["Username"];
            this.Panel2.Visible = true;
            this.Panel1.Visible = false;
            this.Label1.Text = Session["username"].ToString();
        }
        else
        {
            Response.Write("<script language=javascript>alert('用户名或密码错误！');location='javascript:history.go(-1)'</script>");
        }
        comm.Connection.Close();
    }