private void button1_Click(object sender, EventArgs e)
{

    SqlConnection conn = new SqlConnection(@"Data source=.;Initial Catalog=msdb;username=lu;password=lu");
    SqlCommand cmd = new SqlCommand("select * from login where username=@username and password=@password", conn);

    cmd.Parameters.AddWithValue("@username", textBox1.Text);
    cmd.Parameters.AddWithValue("password", textBox2.Text);
    SqlDataAdapter sda = new SqlDataAdapter(cmd);
    DataTable dt = new DataTable();
    sda.Fill(dt);
    conn.Open();
    int i = cmd.ExecuteNonQuery();
    conn.Close();

    if (dt.Rows.Count > 0)
    {
        HttpContext.Current.Session["id"] = textBox1.Text;
        HttpContext.Current.Response.Redirect("LoginPage.cs");
        HttpContext.Current.Session.RemoveAll();

    }
    else
    {
        label1.Text = "your username or password is incorrect";
        label1.ForeColor = System.Drawing.Color.Red;
    }
}

cmd.Parameters.AddWithValue("password", textBox2.Text);
        it should be
     cmd.Parameters.AddWithValue("@password", textBox2.Text);