Login Page Coding VB.Net

Imports System.Data
Imports System.Data.SqlClient

Public Class _default
    Inherits System.Web.UI.Page
    Dim cmd As SqlCommand
    Dim cn As New SqlConnection("Data Source=SARIB-ALI\SQLEXPRESS;Initial Catalog=infra;Integrated Security=True")
    Dim dr As SqlDataReader

    Protected Sub Page_Load(ByVal sender As Object, ByVal e As System.EventArgs) Handles Me.Load

    End Sub

    Protected Sub Button1_Click(sender As Object, e As EventArgs) Handles Button1.Click
        cn.Close()
        cn.Open()
        cmd = New SqlCommand("SELECT * FROM login WHERE username='" & TextBox1.Text & "' AND password = '" & TextBox2.Text & "'", cn)
        cmd.CommandTimeout = 0
        dr = cmd.ExecuteReader
        If dr.HasRows = True Then
            MsgBox("Passed")
            Response.Redirect("welcome.aspx")
        Else
            MsgBox("Failed")
        End If
    End Sub
End Class