title: How can I improve my code?
body: <p>Yesterday I asked a question about the table you guys helped a lot. Someone suggested that I don't directly store the <code>strConnectionString</code> so I changed what I had.</p>
  
  <p>This is my code:</p>
  
  <pre><code>        private void main_B_login_Click(object sender, RoutedEventArgs e)
      {
          //connect to the database
          SqlConnection loginConn = null;
          SqlCommand cmd = null;
          SqlDataAdapter sda = null;
          DataTable dt = new DataTable();
  
          loginConn = new SqlConnection("server=localhost;" + "Trusted_Connection=yes;" + "database=Production; " + "connection timeout=30");
          cmd = new SqlCommand("Select Username FROM [User] WHERE Username =@UsernameValue", loginConn);
          loginConn.Open();
          cmd.CommandType = CommandType.Text;
          cmd.Parameters.Add("@UsernameValue", SqlDbType.VarChar).Value = Main_T_Username.Text;
          sda = new SqlDataAdapter(cmd);
          sda.Fill(dt);
  
          if (dt.Rows.Count &gt; 0)
              {
                  //MessageBox.Show("username");
  
                  SqlConnection loginConn2 = null;
                  SqlCommand cmd2 = null;
                  SqlDataAdapter sda2 = null;
                  DataTable dt2 = new DataTable();
  
                  loginConn2 = new SqlConnection("server=localhost;" + "Trusted_Connection=yes;" + "database=Production; " + "connection timeout=30");
                  cmd2 = new SqlCommand("Select Password FROM [User] WHERE Password =@PasswordValue", loginConn2);
                  loginConn2.Open();
                  cmd2.CommandType = CommandType.Text;
                  cmd2.Parameters.Add("@PasswordValue", SqlDbType.VarChar).Value = Main_T_Password.Text;
                  sda2 = new SqlDataAdapter(cmd2);
                  sda2.Fill(dt2);
  
                  if (dt2.Rows.Count &gt; 0)
                  {
                      MessageBox.Show("username and Password = Correct");
                  }
                  else
                  {
                      MessageBox.Show("Password = Wrong");
                      loginConn2.Close();
                  }
  
               }
              else
              {
                  MessageBox.Show("WrongPass or Username!");
                  loginConn.Close();
              }
  
          }
  </code></pre>
  
  <p>At the moment it works perfectly. I am not sure about two things.</p>
  
  <ol>
  <li><p>Is the connection string now as it stands still "bad" in terms of SQL INJECTION?</p></li>
  <li><p>I have the code basically check first the username then password..? i have stored them both as text values because I don't know how to change it to hashing.</p></li>
  </ol>
  
  <p>Could I simplify the check to do both username and password? but still give out and error when the username is wrong and when the password is wrong?</p>