private void cmdLogin_Click(object sender, System.EventArgs e) {

    string strCnx = ConfigurationSettings.AppSettings["cnxNWindBad"];

    using (SqlConnection cnx = new SqlConnection(strCnx))

    {

        SqlParameter prm;

        cnx.Open();

        string strQry = 

            "SELECT Count(*) FROM Users WHERE UserName=@username " +

            "AND Password=@password";

        int intRecs;

        SqlCommand cmd = new SqlCommand(strQry, cnx);

        cmd.CommandType= CommandType.Text;

        prm = new SqlParameter("@username",SqlDbType.VarChar,50);

        prm.Direction=ParameterDirection.Input;

        prm.Value = txtUser.Text;

        cmd.Parameters.Add(prm);

        prm = new SqlParameter("@password",SqlDbType.VarChar,50);

        prm.Direction=ParameterDirection.Input;

        prm.Value = txtPassword.Text;

        cmd.Parameters.Add(prm);            

        intRecs = (int) cmd.ExecuteScalar();

        if (intRecs>0) {

            FormsAuthentication.RedirectFromLoginPage(txtUser.Text, false);

        }

        else {

            lblMsg.Text = "Login attempt failed.";

        }

    }

}