请问这个代码哪里有错，怎么改？谢谢！
protected void LoginButton_Click(object sender, EventArgs e)
    {

        string username = Request.Form["UserName"];
        string userpwd = Request.Form["Password"];
        OleDbConnection con = DB.createCon();
        con.Open();
        OleDbCommand cmd = new OleDbCommand("select * from [user] where username='" + username + "'and userpwd='" + userpwd + "'", con);
        int count = Convert.ToInt32(cmd.ExecuteScalar());
        if (count > 0)
        {
            Response.Redirect("main.aspx");
        }

     }