c# - Validating username and password in a database in asp.net -

i trying create login page. have database table called login, , has 2 columns: id , password. has following id , password pairs in it: first row:(13282,123456), second row:(11111,11111). if username , password right, redirect page succesful.aspx, if either username or password wrong, redirect page unsuccesful.aspx. problem is, when enter 13283 id , 123456 password, right, redirected succesful page. when enter id=11111 , password=11111 though true, redirects unsuccesful page. think problem is, query checks first row. here code:

 protected void loginbutton_click(object sender, eventargs e) {      sqlconnection con = new sqlconnection();     con.connectionstring = "data source=.\\sqlexpress;initial catalog=university;integrated security=true;pooling=false";       int32 verify;     string query1 = "select count(*) login id='" + idbox.text + "' , password='" + passwordbox.text + "' ";     sqlcommand cmd1 = new sqlcommand(query1, con);     con.open();     verify = convert.toint32(cmd1.executescalar());     con.close();     if (verify > 0)     {         response.redirect("succesful.aspx");     }     else     {         response.redirect("unsuccesful.aspx",true);     }  } 

several things wrong approach:

• it requires storing passwords in plain text - worst thing 1 can user's password: accidentally gains access database instantly in possession of users' passwords, very, bad.
• it susceptible sql injection attacks - concatenating strings produce sql command dangerous, because malicious users enter strings break sql , turn something else.

you should study answers this question. approaches discussed there not simple implementing, make system lot more bullet-proof.