Query a hashed column in SQL

Don't do it like that! Never concatenate strings to build a SQL command. It leaves you wide open to accidental or deliberate SQL Injection attack which can destroy your entire database. Always use Parameterized queries instead.

When you concatenate strings, you cause problems because SQL receives commands like:

SELECT * FROM MyTable WHERE StreetAddress = 'Baker's Wood'

The quote the user added terminates the string as far as SQL is concerned and you get problems. But it could be worse. If I come along and type this instead: "x';DROP TABLE MyTable;--" Then SQL receives a very different command:

SELECT * FROM MyTable WHERE StreetAddress = 'x';DROP TABLE MyTable;--'

Which SQL sees as three separate commands:

SELECT * FROM MyTable WHERE StreetAddress = 'x';

A perfectly valid SELECT

DROP TABLE MyTable;

A perfectly valid "delete the table" command

--'

And everything else is a comment.
So it does: selects any matching rows, deletes the table from the DB, and ignores anything else.

So ALWAYS use parameterized queries! Or be prepared to restore your DB from backup frequently. You do take backups regularly, don't you?

ANd on a login form?
All I have to do is try in teh usrename box:

x' --

And SQL will log me in as any user I like without a password ...

Don't return all columns: You already know what the username is and you ignore everything else.

Checking the hash is easy. There is some information on how to do it here: Password Storage: How to do it.[^]

So once you get those procedures all into place, you will be using code something like this to validate.

SqlConnection sqlconn = new SqlConnection(@"Server= localhost; Database= DatabaseName; Integrated Security=True;");

SqlCommand cmd = new SqlCommand("uspLogin", sqlconn);
cmd.CommandType = CommandType.StoredProcedure;

SqlParameter spResp = New SqlParameter("@responseMessage", SqlDbType.NVarChar, 32);
spResponse.Direction = ParameterDirection.Output;

cmd.Parameters.AddWithValue("@pLoginName", userlogin.Text.Trim());
cmd.Parameters.AddWithValue("@pPassword", passwordbox.Text.Trim());
cmd.Parameters.Add(spResp);

sqlConn.Open();
cmd.ExecuteNonQuery();
string LoginStatus = (string)spResp.value;
cmd.Dispose();
sqlconn.Close();
sqlconn.Dispose();

if (LoginStatus != "User successfully logged in") {
	// Login Failed
} else {
	// continue into application
}

Please note that I am only checking if the login was successful, and not checking why they failed (username or password).
The security standards that I use dictate that we don't tell people why they failed. as that tells too much information; mainly if an account exists or not

SqlParameter reference:
SqlParameter Class (System.Data.SqlClient) | Microsoft Docs[^]