How can I improve my code?
<p>Yesterday I asked a question about the table you guys helped a lot. Someone suggested that I don't directly store the <code>strConnectionString</code> so I changed what I had.</p>

<p>This is my code:</p>

<pre><code>        private void main_B_login_Click(object sender, RoutedEventArgs e)
    {
        //connect to the database
        SqlConnection loginConn = null;
        SqlCommand cmd = null;
        SqlDataAdapter sda = null;
        DataTable dt = new DataTable();

        loginConn = new SqlConnection("server=localhost;" + "Trusted_Connection=yes;" + "database=Production; " + "connection timeout=30");
        cmd = new SqlCommand("Select Username FROM [User] WHERE Username =@UsernameValue", loginConn);
        loginConn.Open();
        cmd.CommandType = CommandType.Text;
        cmd.Parameters.Add("@UsernameValue", SqlDbType.VarChar).Value = Main_T_Username.Text;
        sda = new SqlDataAdapter(cmd);
        sda.Fill(dt);

        if (dt.Rows.Count &gt; 0)
            {
                //MessageBox.Show("username");

                SqlConnection loginConn2 = null;
                SqlCommand cmd2 = null;
                SqlDataAdapter sda2 = null;
                DataTable dt2 = new DataTable();

                loginConn2 = new SqlConnection("server=localhost;" + "Trusted_Connection=yes;" + "database=Production; " + "connection timeout=30");
                cmd2 = new SqlCommand("Select Password FROM [User] WHERE Password =@PasswordValue", loginConn2);
                loginConn2.Open();
                cmd2.CommandType = CommandType.Text;
                cmd2.Parameters.Add("@PasswordValue", SqlDbType.VarChar).Value = Main_T_Password.Text;
                sda2 = new SqlDataAdapter(cmd2);
                sda2.Fill(dt2);

                if (dt2.Rows.Count &gt; 0)
                {
                    MessageBox.Show("username and Password = Correct");
                }
                else
                {
                    MessageBox.Show("Password = Wrong");
                    loginConn2.Close();
                }

             }
            else
            {
                MessageBox.Show("WrongPass or Username!");
                loginConn.Close();
            }

        }
</code></pre>

<p>At the moment it works perfectly. I am not sure about two things.</p>

<ol>
<li><p>Is the connection string now as it stands still "bad" in terms of SQL INJECTION?</p></li>
<li><p>I have the code basically check first the username then password..? i have stored them both as text values because I don't know how to change it to hashing.</p></li>
</ol>

<p>Could I simplify the check to do both username and password? but still give out and error when the username is wrong and when the password is wrong?</p>