Classic User Logon code

Private void btnlogin_serverclick (Object sender, system. eventargs E)
{
Sqlconnection con;
String SQL;
Sqlcommand cmd;
String ID;

Con = new sqlconnection ("Data Source = (local) \ netsdk; initial catalog = friendsdata; user id = sa ");
SQL = "select userid from [user] Where login = '{0}' and Password = '{1 }'";

// Format the string with the values provided
SQL = string. Format (SQL, txtlogin. Value, txtpwd. value );
Cmd = new sqlcommand (SQL, con );
Con. open ();

Try
{
// Retrieve the userid
Id = (string) cmd. executescalar ();
}
Finally
{
Con. Close ();
}

If (ID! = NULL)
{
// Set the user as authenticated and send him to the page originally requested.
Formsauthentication. redirectfromloginpage (ID, chkpersist. Checked );
}
Else
{
This. pnlerror. Visible = true;
This. lblerror. Text = "invalid user name or password! ";
}
}