You declared
conn
and
cmd
as variables but you didn't initialize them with instances of SqlConnection / SqlCommand. You need to either create an instance with the keyword
New
or use the
ProviderFactory[
^]-class to get an instance of them.
The latter (using the ProviderFactory) is recommended because then, if you also use either the abstract Db******-base-classes (like DbConnection, DbCommand, ..) or the interfaces (IDbConnection, IDbCommand, ..) instead of the concrete and SQL-Server-dependent classes (SqlConnection, SqlCommand, ..) you'll make your code independent of a concrete database system and will be able to change from SQL Server to some other DB system easily or at least more easily.
Also, you shouldn't use string concatenation for building SQL-statements. Your code becomes susceptible to SQL-injection and less readable. Use Parameters instead:
SqlCommand.Parameters Property (System.Data.SqlClient)[
^]