How To Block User Accounts After Typing Wrong Passwords Multiple Times

using System;

using System.Collections.Generic;

using System.Linq;

using System.Web;

using System.Web.UI;

using System.Web.UI.WebControls;

using System.Data;

using System.Data.SqlClient;

using System.Drawing;

public partial class Demo : System.Web.UI.Page

{

   SqlConnection con = new SqlConnection(@"Data Source=AAPTI-E86BE99D7\SQLEXPRESS;Initial Catalog=BlockUser;Integrated Security=True");

   SqlCommand cmd = new SqlCommand();

   int intcounter = 0;

   DataSet ds = new DataSet();

   protected void Page_Load(object sender, EventArgs e)

   {

   }

   protected void Button1_Click(object sender, EventArgs e)

   {

       con.Open();

       intcounter = Convert.ToInt32(ViewState["count"]);

       intcounter = intcounter + 1;

       if (intcounter <= 3)

       {

           cmd.CommandText = "Select Username,Password from Login where Username='" + TextBox1.Text + "' and Password='" + TextBox2.Text + "'";

           cmd.Connection = con;

           SqlDataReader dr = cmd.ExecuteReader();

           if (dr.Read() == true)

           {

               Response.Write("<script>alert('Valid User.')</script>");

           }

           else

           {

               string str = (3 - intcounter).ToString();

               ErrorMessage.Text = "We have only " + str + " Remaining";

               ErrorMessage.Visible = true;

               ErrorMessage.ForeColor = Color.Red;

               Response.Write("<script>alert('InValid User.')</script>");

           }

           ViewState["count"]=intcounter;

       }

       else

       {

           ErrorMessage.Text = "You have no attempts your Account is blocked.";

           ErrorMessage.Visible = true;

           ErrorMessage.ForeColor = Color.Red;

       }

   }

}