Password Change in ASP.NET with C#

con.Open();
        SqlCommand cmd = new SqlCommand("select password from login where username='" + Label2 .Text+ "'", con);
        dr = cmd.ExecuteReader(); 
        if (!dr.Read())
        {
            Label6 .Text = ("Wrong Username");
        }
        else if (dr[0].ToString().Trim() == TextBox1.Text.Trim())
        {
            con.Close();
            con.Open();
            SqlCommand cmd1 = new SqlCommand("Update login set password='" + TextBox2.Text + "' where username='" + Label2.Text + "'", con);
            SqlDataReader dr1;
            dr1 = cmd1.ExecuteReader();
            Label6.Text = "Password Changed";
            con.Close();
        }
        else
        {
            Label6.Text = "Wrong Password";
        }