password recovery control

protected void PasswordRecovery1_SendingMail(object sender, MailMessageEventArgs e)
    {
        try
        {
            string str = @"server=localhost;database=asp;uid=sa;pwd=sa";
            SqlConnection conn = new SqlConnection(str);
            conn.Open();
            String strcomand = "Select mailid from asp where name='" + PasswordRecovery1.UserName + "'";
            SqlCommand cmd = new SqlCommand(strcomand, conn);
            SqlDataReader reade = cmd.ExecuteReader();
            while (reade.Read())
            {
                string uname = reade["mailid"].ToString();
            }
        }
        catch (Exception gh)
        {
            Console.WriteLine(gh.StackTrace);
        }
}