getting error when use sqlcommand : I'm getting an error when I used sqlcommand in the code below, please advise.

try
            {
                sqlConnection sqlConnection1 = new sqlConnection("Server=.\\SQLEXPRESS;Database=Bazy;Integrated Security=true ");
                
                SqlCommand cmd1 = new SqlCommand("select pass from Users where user1='" + user + "'",sqlConnection1);
                SqlDataReader sdr;
                
                sqlConnection1.open();

                sdr = cmd1.ExecuteReader();

                if (sdr.GetString(0) == tBox_oldPassword.Text)
                {
                    cmd1.CommandText = "update Users set Pass='" + tBox_newPassword.Text + "' where User1='" + tBox_userName.Text + "'";
                    cmd1.ExecuteNonQuery();
                }
                else
                {
                    MessageBox.Show("ادخل كلمة السر الحالية.");
                }

            }
            catch(Exception ex)
            {
                MessageBox.Show(ex.ToString());
            }

[enter image description here][1]


  [1]: https://i.stack.imgur.com/vO0bc.jpg