خطا در کد لاگین

[HOSSEINONLINE7]

سلام این کد من کجاش اشتباه هست که خطای زیر را میده ؟

Incorrect syntax near ','.


Description: An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code.


Exception Details: System.Data.SqlClient.SqlException: Incorrect syntax near ','.


Source Error:




Line 62: cnn.Open();
Line 63: DataTable dt = new DataTable();
Line 64: dt.Load(cmd.ExecuteReader());
Line 65: cnn.Close();
Line 66: if (dt.Rows.Count == 1)

SqlConnection cnn = new SqlConnection("Data Source=.;Initial Catalog=GRDJahad1;Integrated Security=true"); SqlCommand cmd = new SqlCommand();
cmd.Connection = cnn;
cmd.CommandText = "SELECT [User],[Pass] FROM Logon WHERE [User]" +
"='"+ txtUser.Text +"',and [Pass]='"+ txtPass.Text +"' )";


cnn.Open();
DataTable dt = new DataTable();
dt.Load(cmd.ExecuteReader());
cnn.Close();
if (dt.Rows.Count == 1)
{
Response.Redirect("Edit.aspx");


}

[salar IT man]

سلام ."='"+ txtUser.Text +"',and [Pass]='"+ txtPass.Text +"'
اون [, ] رو بردار