语法错误 看看

protected void btnLogin_Click(object sender, EventArgs e)
    {
        if (txtUsername.Text == "" || txtPassword.Text == "")
        {
            Response.Write("<script language=javascript>alert('用户名或密码不得为空！');</script>");
            return;
        }
        string connsql = System.Configuration.ConfigurationManager.AppSettings["connstring"];
        SqlConnection conn = new SqlConnection(connsql);
        conn.Open();
        string strSql = "select * from users where User_id=sa'" + txtUsername.Text + "'and User_password=123456'" + txtPassword.Text + "'";
        SqlCommand com = new SqlCommand(strSql,conn);
       SqlDataReader dr = com.ExecuteReader();
        if (dr.Read())
        {
            Session["User_id"] = dr["User_id"];
            Session["user_lever"] = dr["User_lever"];