My login is allowing for anyone to login

using System;
using System.Collections.Generic;
using System.Linq;
using System.Web;
using System.Web.UI;
using System.Web.UI.WebControls;
using System.Data.SqlClient;
using System.Configuration;

public partial class Login : System.Web.UI.Page
{
    protected void Page_Load(object sender, EventArgs e)
    {
        if (IsPostBack)
        {
            SqlConnection con = new SqlConnection(System.Configuration.ConfigurationManager.ConnectionStrings["PassConnectionString"].ConnectionString);
            con.Open();

            string cmdStr = "Select count(*) from TableSecurity where EmailAddress='" + TextBoxEA.Text + "'";
            string cmdStr2 = "Select count(*) from TableCEO where EmailAddress ='" + TextBoxEA.Text + "'";
            string cmdStr3 = "Select count(*) from TableIALO where EmailAddress ='" + TextBoxEA.Text + "'";
            SqlCommand userExist = new SqlCommand(cmdStr, con);
            SqlCommand cmd = new SqlCommand("select * from TableSecurity", con);
            SqlCommand cmd2 = new SqlCommand("select * from TableCEO", con);
            SqlCommand cmd3 = new SqlCommand("select * from TableIALO", con);
            int temp = Convert.ToInt32(userExist.ExecuteScalar().ToString());
            if (temp == 1)

                Response.Write("User Name Already Exist!!!<br /> Please Choose Another User Name.");
        }
    
    }

    
    protected void Submit_Click(object sender, EventArgs e)
    {

        SqlConnection con = new SqlConnection(System.Configuration.ConfigurationManager.ConnectionStrings["PassConnectionString"].ConnectionString);
        con.Open();

        string chkUser = "select count(*) from TableCEO where EmailAddress'" + TextBoxEA.Text +"";
            chkUser = "select count(*) from TableIALO where EmailAddress'" + TextBoxPW.Text + "";
            SqlCommand chkUsercmd = new SqlCommand(chkUser, con);
            

        string insCmd = "Insert into TableSecurity (EmailAddress, Password) values (@EmailAddress, @Password)";
        SqlCommand insertUser = new SqlCommand(insCmd, con);
        insertUser.Parameters.AddWithValue("@EmailAddress", TextBoxEA.Text);
        insertUser.Parameters.AddWithValue("@Password", TextBoxPW.Text);
        

        try
        {
            insertUser.ExecuteNonQuery();
            con.Close();
            Response.Redirect("Login.aspx");
        }
        catch (Exception er)
        {
            Response.Write("Something Really Bad Has Happened....Please Try Again.");
        }
        finally
        {
        }
        }

    
    protected void Button1_Click(object sender, EventArgs e)
    {

        SqlConnection con = new SqlConnection(ConfigurationManager.ConnectionStrings["PassConnectionString"].ConnectionString);
        con.Open();

        string cmdStr = "select count(*) from TableCEO where EmailAddress= '" + TextBoxEA.Text + "'";
        SqlCommand Checkuser = new SqlCommand(cmdStr, con);
        int temp = Convert.ToInt32(Checkuser.ExecuteScalar().ToString());
        if (temp == 1)
        {
            string cmdStr2 = "select Password from TableSecurity where Password = '" + TextBoxPW.Text + "'";
            SqlCommand pass = new SqlCommand(cmdStr2, con);
            string password = pass.ExecuteScalar().ToString();
            con.Close();

            if(password == TextBoxPW.Text)
            {
                Session["New"] = TextBoxEA.Text;
                Response.Redirect("Secure.aspx");
            }
            else
            {
                Label1.Visible = true;
                Label1.Text = "Invalid Password...!!";
            }
        }
            else
            {
                Label1.Visible = true;
                Label1.Text = "Invalid EmailAddress...!!";
        }
    }
}