i want to login and if some one enters the password wronly for more than 3 time his account gets locked. for this have done code in the login button pls help wht went wrong

protected void Button1_Click(object sender, EventArgs e)
    {
        SqlCommand cmd = new SqlCommand("select count(*) from logn where username=@username",con);
        cmd.Parameters.AddWithValue("@username",TextBox1.Text);
        con.Open();
        int userexist =  (int)cmd.ExecuteScalar();


        SqlCommand cmd1 = new SqlCommand("select count(*) from logn where pasword=@password", con);
        cmd1.Parameters.AddWithValue("@password", TextBox1.Text);
        int correctpass = (int)cmd1.ExecuteScalar();


        SqlCommand cmdlogin = new SqlCommand("select username,pasword,locked from logn where username=@usernam and pasword=@password", con);
      
        cmdlogin.Parameters.AddWithValue("@usernam", TextBox1.Text);
        cmdlogin.Parameters.AddWithValue("@password", TextBox2.Text);
        SqlDataReader dr = cmdlogin.ExecuteReader();
    
        while(dr.Read())
        {
            if ((char)dr[2] != 't')
            {
                Session["active"] = 't';
                Response.Redirect("page2.aspx");
            }
           
        }
        if(dr.Read()!=true)
        {
            if (userexist == 0)
            {
                Response.Write("<script>alert('user does not exist register yourself')</script>");
                Response.Redirect("Default.aspx");
            }
            else if(userexist==1 && correctpass==0)
            {
                Response.Write("<script>alert('invalid password')</script>");
                TextBox2.Text = "";
                TextBox2.Focus();
                Session["lock"] = ((int)Session["lock"] + 1);
            }

            if((int)Session["lock"]>3)
            {
                SqlCommand cmdupdate = new SqlCommand("update logn set locked='t' where username='"+TextBox1.Text+"'",con);
                con.Open();
                cmdupdate.ExecuteNonQuery();
            }
           
        
        }
        con.Close();