Why is this code not working?

Apart from the answer of Raiskazi I would suggest to use Parameterized query to avoid SQL injection[^] attacks.

Raiskazi's way is better. But what you did should also give correct output.
Check,

if(ds.Tables[0].Rows.Count !=0)

In your case it should be zero.

Regards.

You are using two global variable:username and password

check whether in page load you are assigning them to blank or not.

if yes then you should not do that or do like below. you should have knowledge about asp.net page life cycle.

if(!IsPostbask)
{
      username="";
      password="";
}

because without this if you will try to assign variables then every time on post back they will get reassign to black.

i think it will help you.

except check the for loop you can directly check like this :-

if(ds.tables[0].rows.count>0)
{
Response.Redirect("Default.aspx");
}
else
{
Label1.text="User Name and Password Incorrect";
}

//
If You Want to Work With Your Coading Then
I thin You have to declare your variable "c" globally.

You have missed there to check table.

protected void ulogin_Click(object sender, EventArgs e)
    {
        SqlConnection con = new SqlConnection(ConfigurationManager.ConnectionStrings["connection"].ConnectionString);
        con.Open();
        SqlDataAdapter sda = new SqlDataAdapter("Select * from registration where username='" + username + "' and password='" + password + "'", con);
        DataSet ds = new DataSet();
        sda.Fill(ds);

        int c = 0;
        if (ds.Tables.Count > 0)
        {
            foreach (DataRow dr in ds.Tables[0].Rows)
            {
                c++;
            }

        }
        con.Close();
        try
        {
            if (c > 0)
            {
                Response.Redirect("default.aspx");

            }
            else
            {
                invalidpassuname.Visible = true;
                username.Text = password.Text = "";
            }
        }
        catch (Exception ex)
        {

        }
    }

//You can try this. don't worry about postback effect(like variable losses values)
// and also check the dataSet contains a data or not

protected void ulogin_Click(object sender, EventArgs e)
   {
       SqlConnection con = new SqlConnection(ConfigurationManager.ConnectionStrings["connection"].ConnectionString);
       con.Open();
       SqlDataAdapter sda = new SqlDataAdapter("Select * from registration where username='" + username.text + "' and password='" + password.text + "'",con);
       DataSet ds = new DataSet();
       sda.Fill(ds);

       int c=0;
       if(ds.Tables[0].Rows.Count > 0)
       foreach(DataRow dr in ds.Tables[0].Rows)
       {
           c++;
       }
       con.Close();
       try
       {
           if (c > 0)
           {
               Response.Redirect("default.aspx");

           }
           else
           {
               invalidpassuname.Visible = true;
               username.Text = password.Text = "";
                           }
       }
       catch (Exception ex)
       {

       }
   }