sql - C# Login Form Secure/Correct? -

i'm making final project c# (school) year , promised last time got on site make sure sql secure , make application secure. on login screen , tell me if proper , secure way?

i start opening main mdicontainer via program.cs:

private void form1_load(object sender, eventargs e)     {         fl.showdialog();     } 

then login form shows:

string user = txtuser.text;         string pw = txtpw.text;         int correct = cldatabase.login(user, pw);          if (correct == 1)         {             this.hide();         }         else         {             messagebox.show("de gegevens die u heeft ingevult kloppen niet", "fout!"); //above means input not correct         } 

and in cldatabase.login

public static int login(string gebruikersnaami, string wachtwoordi)     {         int correct = 0;         sqlconnection conn = new sqlconnection(clstam.connstr);         conn.open();         using (sqlcommand strquer = new sqlcommand("select * gebruiker usernm=@userid , userpass=@password", conn))         {             strquer.parameters.addwithvalue("@userid", gebruikersnaami);             strquer.parameters.addwithvalue("@password", wachtwoordi);             sqldatareader dr = strquer.executereader();             if (dr.hasrows)             {                 correct = 1;                 messagebox.show("loginsuccess");             }             else             {                 correct = 2;                 //invalid login             }         }         conn.close();         return correct;     } 

dialog loginsucces there debug purposes atm secure? proper way have login form?

edit updated code login form:

private void button1_click(object sender, eventargs e)     {         errorprovider ep = new errorprovider();          if (txtuser.text == string.empty || txtpw.text == string.empty)         {             if (txtuser.text == string.empty)                 txtuser.backcolor = color.red;             if (txtpw.text == string.empty)                 txtpw.backcolor = color.red;              messagebox.show("er moet wel iets ingevuld zijn!", "fout");         }         else         {             string user = txtuser.text;             string pw = txtpw.text;             boolean correct = cldatabase.login(user, pw);              if (correct == true)             {                 this.hide();             }             else             {                 messagebox.show("deze combinatie van username en password niet bekend", "fout!");             }         }     }  cldatabase: public static boolean login(string gebruikersnaami, string wachtwoordi)     {         boolean correct = false;         using (sqlconnection conn = new sqlconnection(clstam.connstr))         {             conn.open();             using (sqlcommand strquer = new sqlcommand("select * gebruiker usernm=@userid , userpass=@password", conn))             {                 strquer.parameters.addwithvalue("@userid", gebruikersnaami);                 strquer.parameters.addwithvalue("@password", wachtwoordi);                 using (sqldatareader dr = strquer.executereader())                 {                     if (dr.hasrows)                     {                         correct = true;                     }                     else                     {                         correct = false;                         //invalid login                     }                 }             }             conn.close();         }         return correct;     } 

it secure far sql injection concerned, passing parameters. but, not store password plain text, instead store hashed value.

see: how securely save username/password (local)?