help me out with a login code

string str = "select * from empbirth where UserID=@userid and password=@pass";
            SqlConnection cnn=new SqlConnection();
            cnn.ConnectionString="Your connection string";
            cnn.Open();
            SqlCommand cmd = new SqlCommand(str, cnn);
            cmd.Parameters.AddWithValue("userid", txtUId.Text);
            cmd.Parameters.AddWithValue("pass", txtpwd.Text);
            SqlDataReader dr = cmd.ExecuteReader();

            if (dr.Read())
            {
               //take any action
            }
else
{
Response.Write("INVALID ATTEMPT");
}