Dim Statement As String = "Select * from login where username='" + col1 + "' and password='" & col2.ToString & "'" 'Create Command
Dim cmd As New MySqlCommand(Statement, connection)

Dim Statement As String = "Select * from login where username='@col1' and password='" & col2.ToString & "'" 'Create Command
Dim cmd As New MySqlCommand(Statement, connection)
cmd.Parameters.AddWithValue("@col1", col1.ToString)