用户代码NullReferenceException未将对象引用设置到对象的实例

            {
                SqlDataReader dr = cmd.ExecuteReader();
                //如果取到数据
                if (dr.Read())
                {
                    head.Text = dr["Title"].ToString();
                    content.Text = dr["Content"].ToString();
                    man.Text = dr["Publicman"].ToString();
                    riqi.Text = Convert.ToDateTime(dr["Publictime"]).ToString();
                }

            }
            catch (Exception error)
            {
                Response.Write(error.ToString());
            }
这段代码出的问题？

这程序：
1、安全问题：你获取form或者是QueryString的ID值，根本没经过任何判断就直接拼接SQL语句执行，这是最大的安全隐患。建议：整形先int.TryParse一下，非整形，判断敏感字符，或者写正则判断。
2、DataReader的效率很高，不过如果你在读取的时候操作很多内容，如你这样设置页面的控制值，这样很占用系统资源，很可能会发生问题，比如，DataReader超时了。建议：用实体类保存值，实在不行你用最简单的DataSet吧，虽然性能差了点。

以目前你发的程序，做完这两条，我相信你能解决你的问题了。

using System;
using System.Data;
using System.Data.SqlClient;
using System.Configuration;
using System.Collections;
using System.Web;
using System.Web.Security;
using System.Web.UI;
using System.Web.UI.WebControls;
using System.Web.UI.WebControls.WebParts;
using System.Web.UI.HtmlControls;

public partial class student : System.Web.UI.Page
{
    protected void Page_Load(object sender, EventArgs e)
    {
        if (!IsPostBack)
        {
            //数据库的连接
            SqlConnection conn = new SqlConnection();
            conn.ConnectionString = "Data Source=.;Initial Catalog=usersinfo;Integrated Security=SSPI";
            //存储过程实例化
            SqlCommand cmd = new SqlCommand();
            cmd.Connection = conn;
            //选出符合SQL语句执行后的列的全部结果
             = "select * from users where uid = @id";
            cmd.Parameters.Add(new SqlParameter("@id", SqlDbType.VarChar, 50));
            cmd.Parameters["@id"].Value = Session["uid"].ToString();
            conn.Open();
            //读取1行记录
            SqlDataReader dr = cmd.ExecuteReader();
            if (dr.Read())
            {
                Label1.Text = dr[0].ToString();
                Label2.Text = dr[1].ToString();
                Label3.Text = dr[2].ToString();
                Label4.Text = dr[3].ToString();
                Label5.Text = dr[4].ToString();
                Label6.Text = dr[5].ToString();
                Label7.Text = dr[7].ToString();
                TextBox1.Text = dr[8].ToString();
                TextBox2.Text = dr[9].ToString();
                TextBox3.Text = dr[10].ToString();
            }
            conn.Close();
        }
        
    }
    protected void Button1_Click(object sender, EventArgs e)
    {
        SqlConnection conn = new SqlConnection();
        conn.ConnectionString = "Data Source=.;Initial Catalog=usersinfo;Integrated Security=SSPI";
        conn.Open();
        SqlCommand cmd = new SqlCommand();
        cmd.Connection = conn;
         = "update users set uaddress='" + TextBox1.Text + "',uphone='" + TextBox2.Text + "',uemail='" + TextBox3.Text + "' where uid='" + Session["uid"].ToString() + "'";
        int i = cmd.ExecuteNonQuery();
        if (i == 0)
        {
            Response.Write("<script language='javascript'>alert('修改信息失败！');window.location.href='admin.aspx';</script>");
        }
        else
        {
            Response.Write("<script language='javascript'>alert('修改信息成功！');window.location.href='admin.aspx';</script>");
        }
        conn.Close();
    }
}
红色字体部分提示：用户代码未处理BullReferenceException，未将对象引用设置到对象实例
使用new关键字创建对象实例在调用方法前通过检查确定对象是否为空。
请问各位高手是怎么回事呢？求帮忙。