You'll probably laugh yourself silly when I point it out to you, but here I go anyway:
The "else" part will of course never execute, because the SQL select statement will only return a row from the table login if both the username and the password match.
Since there will only be a row if and when they match you can rewrite your code like this (only the outer if is nescessary):
If your datamodel is correct you don't even have to check if there are more than one row.
Please also observe this: Never construct your SQL statements by concatenating strings, use SqlParameters instead.