facing problem while executing vb.net query

Question

Dim con As SqlConnection
        con = New SqlConnection("server=chinna; uid=sa; pwd=136018@h; database=icms")
        con.Open()
        Dim cmd As SqlCommand
        cmd = New SqlCommand("select pass from personal where idno=" & TextBox1.Text, con)
        cmd.CommandType = CommandType.Text
        Dim rdr As SqlDataReader
        rdr = cmd.ExecuteReader
        If rdr.Read() Then

            TextBox2.Text = rdr.ToString()
            Response.Redirect("default.aspx")
        Else
            MsgBox("incorrect password")

Answer 1

You need to use parameters in your query:

cmd = New SqlCommand("select pass from personal where idno=@param", con)
cmd.Parameters.AddWithValue("param", TextBox1.Text);