c# - user and password authentication asp.net -

the user , password correct returning incorrect. can be?

importantly, password , encrypted in md5.

public static bool logarusuario(string user, string pw)     {         try         {             const string checkuser = "select count(*) tbusuario username = '@user'";              sqlconnection con = banco.con();              con.open();              sqlcommand cmd = new sqlcommand(checkuser, con);              int temp = convert.toint32(cmd.executenonquery().tostring());              cmd.parameters.addwithvalue("@user", user);             con.close();              if (temp == 1)             {                  con.open();                 string checkpw = "select pw tbusuario username = '@user'";                 sqlcommand passconn = new sqlcommand(checkpw, con);                  cmd.parameters.addwithvalue("@user", user);                  string password = passconn.executescalar().tostring();                  registrar criptografia = new registrar();                  if (password == pw)                 {                      return true;                 }                                 }         }         catch (sqlexception ex)         {             console.writeline("erro " + ex.message);                         }          return false;     } 

within btnlogar click event:

already checked database , username , password correct, incorrect password.

 protected void bntlogar_click(object sender, eventargs e)     {         registrar criptografia = new registrar();          if (login.logarusuario(txtuser.text, criptografia.criptografiamd5(txtsenha.text)))         {             //cria um cookie lado servidor             httpcookie cookie = new httpcookie("estado", "conectado");              //define validade cookie (10 dias partir de hoje)             cookie.expires = datetime.now.addmonths(12);              //envia o cookie para o cliente             response.cookies.set(cookie);              //redireciona para pagina inicial             response.redirect("admin.aspx");         }         else         {             lblerro.text = "usuário ou senha incorretos";             lblerro.visible = true;             lblerro.cssclass = "alert alert-danger";         }      } 

you can single select statement

public static bool logarusuario(string user, string pw) {  const string checkuser =     @"select count(*) tbusuario        username = @u , pw = @p";   using (sqlconnection con = banco.con())  {    con.open();    sqlcommand cmd = new sqlcommand(checkuser, con);    cmd.parameters.addwithvalue("@u", user);    cmd.parameters.addwithvalue("@p", pw);     return 1 == (int) cmd.executenonquery();  } } 

this assumes pw hashed.