Improving ASP.Net login code and checking if user is logged in
<p>There are two things I want to accomplish with my ASP.net code which I am struggling to right now because I am a beginner:</p>

<p>1) My code in <strong>Login.aspx</strong> is currently susceptible to SQL injection, how can I minimise my risk of SQL injection?</p>

<pre><code>using System;
using System.Collections;
using System.Configuration;
using System.Data.SqlClient;
using System.Data;
using System.Linq;
using System.Web;
using System.Web.Security;
using System.Web.UI;
using System.Web.UI.HtmlControls;
using System.Web.UI.WebControls;
using System.Web.UI.WebControls.WebParts;
using System.Xml.Linq;
using System.Web.Configuration;

public partial class login : System.Web.UI.Page
{

    protected void Login1_Authenticate(object sender, AuthenticateEventArgs e)
    {
        string username = Login_Box.UserName;
        string pwd = Login_Box.Password;

        string strConn;
        strConn = WebConfigurationManager.ConnectionStrings["team13ConnectionString"].ConnectionString;
        SqlConnection Conn = new SqlConnection(strConn);
        Conn.Open();

        string sqlUserName;
        sqlUserName = "SELECT id,pass FROM ts_dept ";
        sqlUserName += " WHERE (id ='" + username + "')";
        sqlUserName += " AND (pass ='" + pwd + "')";
        SqlCommand com = new SqlCommand(sqlUserName, Conn);

        string CurrentName;
        CurrentName = (string)com.ExecuteScalar();

        if (CurrentName != null)
        {
            Session["UserAuthentication"] = username;
            Session.Timeout = 1;
            Response.Redirect("Default.aspx");
        }
        else
        {
            Session["UserAuthentication"] = "";
        }
    }
}
</code></pre>

<p>2) <strong>Default.aspx</strong> is the home page of my website. It cannot be accessed if the user has not logged in, how do I check for Session["Authentication"] here (if null then the user is redirected to <strong>Login.aspx</strong>. Here is my code so far:</p>

<pre><code>using System;
using System.Collections.Generic;
using System.Linq;
using System.Web;
using System.Web.UI;
using System.Web.UI.WebControls;

namespace Team13
{
    public partial class default : System.Web.UI.Page
    {

    }
}
</code></pre>
