protected void Button1_Click(object sender, EventArgs e)
{
    SqlConnection con = new SqlConnection(ConfigurationManager.ConnectionStrings["DefaultConnection"].ToString());
    con.Open();

    string query = "select * from login where user_login='" + txtuser.Text+ "' and '" + txtpass.Text + "' ";

    SqlCommand cmd = new SqlCommand(query, con);

    string output = cmd.ExecuteScalar().ToString();

    if (output == "0")
    {
        Session["user"] = txtuser.Text;
        Response.Redirect("");
    }
    else
        Response.Write("Login Failed");
}

and user_password = '" + txtpass.Text + "' ";

SELECT * FROM UserLogin WHERE Username = @Username AND Password = @Password

SqlCommand cmd = new SqlCommand(sql, sqlcon);
using (cmd)
{
     sqlcom.Parameters.Add(new SqlParameter("@Username", TextBox1.Text));
     string output = cmd.ExecuteScalar().ToString();
}