forgot password and sending recovery link as Email in C#

protected void btnSubmit_Click(object sender, EventArgs e)
{


DataSet ds_sendmail = new DataSet();
SqlDataAdapter da_sendmail = new SqlDataAdapter("select * from LOGIN_USERDETAILS where EmailAddress='" + txtEmailAddress.Text.Trim() + "'", con);
da_sendmail.Fill(ds_sendmail);
if (ds_sendmail.Tables[0].Rows.Count > 0)
{
string Username = ds_sendmail.Tables[0].Rows[0]["Username"].ToString();
int Uid = int.Parse(ds_sendmail.Tables[0].Rows[0]["Uid"].ToString());
string Email=ds_sendmail.Tables[0].Rows[0]["EmailAddress"].ToString();
string resetdate=DateTime.Now.ToString();

string Empname = ds_sendmail.Tables[0].Rows[0]["Firstname"].ToString() + " " + ds_sendmail.Tables[0].Rows[0]["Lastname"].ToString() + ",";
string Title = "Password Recovery Link";

if (Username != null)
{
Guid guid;
guid = Guid.NewGuid();
using (SqlCommand command = new SqlCommand())
{
command.Connection = new SqlConnection(ConfigurationManager.ConnectionStrings["DefaultConnectionString"].ConnectionString);
command.CommandText = @"insert into [Password_Reset](Uid, Username, EmailAddress, Guid, Pwddate,active)
values(@Uid, @Username, @Email, @Guid, @Pwddate,@active)";
command.Parameters.Add("@Uid", SqlDbType.Int).Value =Uid;
command.Parameters.Add("@Username", SqlDbType.NVarChar, 50).Value = Username;
command.Parameters.Add("@Email", SqlDbType.NVarChar, 200).Value = Email;
command.Parameters.Add("@Guid", SqlDbType.UniqueIdentifier).Value = guid;
command.Parameters.Add("@Pwddate", SqlDbType.DateTime).Value = resetdate;
command.Parameters.Add("@active", SqlDbType.Int).Value = 1;
command.Connection.Open();
command.ExecuteNonQuery();
}
string pwdlink = "Click this link to reset your Password";

ToEmailId = txtEmailAddress.Text.Trim();
Description = "

Password Reset :

" + "\r\n";
Description += "

You are receiving this email because you filled out a form on alphastaff indicating that you had forgotten your password

" ;
Description += "

You can reset your Password using following link :

" + "\r\n";
Description += "

"+pwdlink+"

";
Description += "

This link can be used for only once

";
Description += "

This link will be expired after 24 hours

";
Description += "

Thanks & Regards

Alphastaff Team

";
Sendmail.Send(Empname,ToEmailId, Title, Description, FromEmaiId);
lblMsg.Visible = true;
lblMsg.Text = "* Password reset link has sent to your Email address";
txtEmailAddress.Text = "";
}
}
else
{
lblMsg.Visible = true;
lblMsg.Text = "* Given Emailaddress is Invalid !";
}

}

Password Reset Page :


using System;
using System.Data;
using System.Data.SqlClient;
using System.Configuration;
using System.Collections;
using System.Web;
using System.Web.Security;
using System.Web.UI;
using System.Web.UI.WebControls;
using System.Web.UI.WebControls.WebParts;
using System.Web.UI.HtmlControls;
using System.Net.Mail;
using Common.BOL;
using Login_Page.BOL;

public partial class PEO_PasswordReset : System.Web.UI.Page
{
SqlConnection con = new SqlConnection(System.Configuration.ConfigurationManager.AppSettings["dbstring"].ToString());
Login_Page_frm ap = new Login_Page_frm();
string Uid;
string ResetID;
protected void Page_Load(object sender, EventArgs e)
{
if (Request.QueryString["ResetID"] != null)
{
ResetID = Request.QueryString["ResetID"].ToString();

DataSet ds_sendmail = new DataSet();
SqlDataAdapter da_sendmail = new SqlDataAdapter("select * from Password_Reset where Guid='" + ResetID + "' and active=1", con);
da_sendmail.Fill(ds_sendmail);
if (ds_sendmail.Tables[0].Rows.Count > 0)
{
DateTime dTFrom;
DateTime dTo;
string sFrom = ds_sendmail.Tables[0].Rows[0]["Pwddate"].ToString();
string sTo = DateTime.Now.ToString();
if (DateTime.TryParse(sFrom, out dTFrom) && DateTime.TryParse(sTo, out dTo))
{
TimeSpan TS = dTo.Subtract(dTFrom);
int diff_total_seconds = int.Parse(TS.TotalSeconds.ToString());

if (diff_total_seconds>86400)
{
Response.Redirect("~/LinkExpiry.aspx");
}

}
string Username = ds_sendmail.Tables[0].Rows[0]["Username"].ToString();
Uid = ds_sendmail.Tables[0].Rows[0]["Uid"].ToString();
string Email = ds_sendmail.Tables[0].Rows[0]["EmailAddress"].ToString();
string resetdate = DateTime.Now.ToString();

}
else
{
Response.Redirect("~/LinkExpiry.aspx");
}
}
else
{
Response.Redirect("~/LinkExpiry.aspx");
}
}
protected void btnSubmit_Click(object sender, EventArgs e)
{

ap.Action = 2;
ap.Password = Common.BOL.Common_Details.Encrypt(txtNewpwd.Text);
ap.Pwddate = Convert.ToDateTime(System.DateTime.Now.ToString("d"));
ap.UserId =int.Parse(Uid);
Login_Page_frm.Add_Update_delete_Login_Page_Pwd(ap);

using (SqlCommand command = new SqlCommand())
{
command.Connection = new SqlConnection(ConfigurationManager.ConnectionStrings["DefaultConnectionString"].ConnectionString);
command.CommandText = @"update [Password_Reset] set active=@active where Guid='" + ResetID + "'";
command.Parameters.Add("@Uid", SqlDbType.Int).Value = Uid;
command.Parameters.Add("@active", SqlDbType.Int).Value = 0;
command.Connection.Open();
command.ExecuteNonQuery();
}

lblErrmsg.Text = "* Password has been reset!";
lblErrmsg.Visible = true;
Response.Redirect("~/Login.aspx");


}
}