You did it backwards. You asked if the text in the textbox Contains a character.
You need to do it the other way around.
Keep in mind that this is not a "production quality" piece of code as this method is case- and whitespace-sensitive. If the user types " 2345", it will not be found in the valid code list.