Users logged in time and logged out time

string connectionString = ConfigurationManager.ConnectionStrings["TestConnectionString"].ConnectionString;
               connection = new SqlConnection(connectionString);
               connection.Open();
               //prepare sql statements
               string sql = "SELECT * from Member where member='" + member + "' And Password='" + password + "'";
               Response.Write(sql);
               SqlCommand cmd = new SqlCommand("INSERT INTO LoggedInUsers (@LoginTime)", connection);
               cmd.Parameters.Add("@LoginTime", SqlDbType.DateTime).Value = tm;
               command = new SqlCommand(sql, connection);