Unsuccesful Login Attempts code

You don't appear to have a method called ExecuteQuery

Plus as _Zorro_ has said - you have left yourself wide open to SQL Injection attacks - see http://blog.codinghorror.com/give-me-parameterized-sql-or-give-me-death/[^]

Use parameterized queries and the appropriate method e.g.

string sql = "Select count(*) from Table22 where EmailAddress = @TextBoxEA AND Password=@TextBoxPW";
SqlCommand newCommand = new SqlCommand(sql);
newCommand.Parameters.Add("@TextBoxEA", TextBoxEA.Text);
newCommand.Parameters.Add("@TextBoxPW", TextBoxPW.Text);
int retValue = (int)newCommand.ExecuteScalar();

and/or

string SQL = "Update Table22 SET isLocked = true where EmailAddress = @TextBoxEA"; //.Text typo removed in V2 of solution
SqlCommand newCommand1 = new SqlCommand(SQL);
newCommand1.Parameters.Add("@TextBoxEA", TextBoxEA.Text);
int rowsAffected = newCommand1.ExecuteNonQuery();

[EDIT in response to OP comment]
Here is an example of how I might integrate the solution above into your code, with some refactoring. I have omitted the error handling (try-catch) and warning this code is untested.

protected void Page_Load(object sender, EventArgs e)
{
    TextBoxEA.Focus();

    if (!IsPostBack)
    {
        Session["counter"] = 0;    // Initialise the number of attempts
        // In the original code this was happening every time so
        // Number of attempts was always equal to 1
    }
    else
    {
        //Increment the number of attempts
        Session["counter"] = Convert.ToInt32(Session["counter"]) + 1;

        //Set up the connection
        //The "using" will close and dispose of the connection when we're finished
        using (SqlConnection con = new SqlConnection(System.Configuration.ConfigurationManager.ConnectionStrings["HotConnectionString"].ConnectionString))
        {
            con.Open();

            string cmdStr = "Select count(*) from Table22 where EmailAddress=@TextBoxEA";
            SqlCommand sqlCmd = new SqlCommand(cmdStr);
            sqlCmd.Parameters.Add("@TextBoxEA", TextBoxEA.Text);
            int userExists = (int)sqlCmd.ExecuteScalar();

            cmdStr = "Select count(*) from Table22 where EmailAddress = @TextBoxEA AND Password=@TextBoxPW";
            sqlCmd = new SqlCommand(cmdStr);
            sqlCmd.Parameters.Add("@TextBoxEA", TextBoxEA.Text);
            sqlCmd.Parameters.Add("@TextBoxPW", TextBoxPW.Text);
            int correctPassword = (int)sqlCmd.ExecuteScalar();

            // You now have userExists =0 if user does not exist, 1 if exists and is only one,
            // and >1 if more than one user with that logon (you should prevent this from happening)
            //
            // You also have correctPassword = 0 if password incorrect, 1 if correct
            // (and >1 as above if more than one entry on database - which you will prevent)

            string msg = "";
            if (userExists == 0)
                msg = "alert('User Name Does Not Exist You Must Fill Out Registration First');";
            else if (correctPassword == 0)
                msg = "alert('Invalid UserName / Password');";
            else if (Convert.ToInt32(Session["counter"]) >= 3)
            {
                msg = "alert('The Account is Locked');";

                // Lock the account on the database
                // Note that you are locking the account but not checking for the lock
                // when looking the user up in the database on subsequent attempts

                cmdStr = "Update Table22 SET isLocked = true where EmailAddress = @TextBoxEA";
                sqlCmd = new SqlCommand(cmdStr);
                sqlCmd.Parameters.Add("@TextBoxEA", TextBoxEA.Text);
                sqlCmd.ExecuteNonQuery();
            }
            if (msg.Length > 0)
            {
                ScriptManager.RegisterStartupScript(this, this.GetType(), "script", msg, true);
                TextBoxEA.Text = string.Empty;
            }
        }   // end using(con)

    }
}