check this coding once which for displaying captcha image

[readnlearn]

hai,
i have written this below code for displaying captcha image whenever i entered incorrect uname,password in login page.
for that i disable the controls of captcha like textbox,labels,button and image control in source code of designing part.
and i enable those controls in an if condition which display captcha.
but if i entered correct information which is in database
it shouldn't navigate to the corresponding page
and also if entered incorrect data it shouldn't displys captcha.
whats problem behind this coding?
check it
and give correct code for this one if any.


namespace CaptchaImage
{
public partial class DefaultImage : System.Web.UI.Page
{
static int a = 0;
protected void Page_Load(object sender, EventArgs e)
{
if (!this.IsPostBack)

// Create a random code and store it in the Session object.
this.Session["CaptchaImageText"] = GenerateRandomCode();

else
{
// On a postback, check the user input.
if (this.CodeNumberTextBox.Text ==
this.Session["CaptchaImageText"].ToString())
{
// Display an informational message.
this.MessageLabel.CssClass = "info";
this.MessageLabel.Text = "Correct!";
}
else
{
//Display an error message.
this.MessageLabel.CssClass = "error";
this.MessageLabel.Text = "ERROR: Incorrect, try again.";

// Clear the input and create a new random code.
this.CodeNumberTextBox.Text = "";
this.Session["CaptchaImageText"] = GenerateRandomCode();
}
}

}
private Random random = new Random();
private string GenerateRandomCode()
{
string s = "";
for (int i = 0; i < 6; i++)
s = String.Concat(s, this.random.Next(10).ToString());
return s;
}

#region Web Form Designer generated code
override protected void OnInit(EventArgs e)
{

// CODEGEN: This call is required by the ASP.NET Web Form Designer.

InitializeComponent();
base.OnInit(e);
}

//<summary>
// Required method for Designer support - do not modify
// the contents of this method with the code editor.
// </summary>
private void InitializeComponent()
{
this.Load += new System.EventHandler(this.Page_Load);

}
#endregion

protected void Button1_Click(object sender, EventArgs e)
{
SqlConnection con = new SqlConnection("initial catalog=rajitha;data source=sys01;user id=sa");

con.Open();
// SqlDataReader dr = null;
SqlCommand cmd = new SqlCommand();
cmd.Connection = con;
cmd.CommandText = "select Emailid,password from tbl_registration where Emailid='" + TextBox1.Text + "' and password='" + TextBox2.Text + "'";
cmd.CommandType = CommandType.Text;
SqlDataReader dr = cmd.ExecuteReader();
// string uname = TextBox1.Text;
//string pwd = TextBox2.Text;
// if (dr.HasRows)
// {
if (dr.Read())
{
Session["Emailid"] = TextBox1.Text;
Session["password"] = TextBox2.Text;
// if (uname == dr["Emailid"].ToString() && pwd == dr["password"].ToString())
Server.Transfer("Default2.aspx");
return;
}
else
{
Response.Write("you have entered incorrect user name,password");
// label3.Text = "you have entered incorrect username,password";
a = a + 1;
if (a > 2)
{
lb1.Enabled = true;
lb2.Enabled = true;
lb3.Enabled = true;
CodeNumberTextBox.Enabled= true;
rfd.Enabled=true;
MessageLabel.Enabled=true;
SubmitButton.Enabled = true;
img1.Visible =true;
}
}
}
con.Close();
}
}

}