sql injection problem

 i have code for login. and i have to prevent to attacks to database.
can u advise abot sql injection . what re the wrong in this code and what can we add to code for avoiding sql injection
thaks
sql = " SELECT ";
        sql += " KODU,k.username, k.password,k.adi,k.soyadi,k.grupkodu,";
        sql += " k.KIMLIKNO";
        sql += " FROM users k";
        sql += " WHERE 1=1 ";
        sql += " AND k.username='" + txtUser.Text.ToUpper().Trim() + "' AND k.password='" + txtPass.Text.Trim() + "'";
        

...