WHERE UserName=
AND Password=
That's plainly invalid, the right sides of the equal operations are missing.