求教一个SQL语句的问题 - .NET技术 / ASP.NET

public partial class MasterPage : System.Web.UI.MasterPage
{
  string sqlConnString = ConfigurationManager.ConnectionStrings["ConnectionString"].ConnectionString;
  protected void Page_Load(object sender, EventArgs e)
  {  
  if (Session["Username"] == null)
  Response.Redirect("admin.aspx");
  string username = Session["Username"].ToString();
  Label1.Text = Session["Username"].ToString();
  Label2.Text = DateTime.Now.ToShortDateString();
  if (!IsPostBack)
  {
  using (SqlConnection con = new SqlConnection(sqlConnString))
  {
  SqlCommand cmd = con.CreateCommand();
  cmd.CommandText = "SELECT RoleID form admin where username='"+ username+"'";
  con.Open();
  SqlDataReader ds = cmd.ExecuteReader();
  if (ds.Read())
  {
  HiddenField1.Value = ds["RoleID"].ToString();
  }
  ds.Close();
  con.Close();
  }
  }
&n