简单学生图书管理系统

string learnid, lpassword;
                    bool flag = false;
                    learnid = textBox1.Text.Trim();
                    lpassword = textBox2.Text.Trim();
                    SqlConnection conn = new SqlConnection("data source=FJ-PC\\SQLEXPRESS;uid=jzx;pwd=neso;database=library");
                    conn.Open();
                    string sqlstring = "select learnid,lpassword from StudentInfo where learnid='" learnid "'and lpassword='" lpassword "'";
                    SqlCommand comm = new SqlCommand(sqlstring, conn);
                    SqlDataReader thisReader = comm.ExecuteReader();                    while (thisReader.Read())
                    {
                        if ((thisReader.GetValue(0).ToString().Trim()) == learnid.ToString().Trim())
                        {
                            if ((thisReader.GetValue(1).ToString().Trim()) == lpassword.ToString().Trim())
                            {
                                flag = true;   
                            }             
                        }    
                    }
                    conn.Close();