Edit Data ASP.Net C#

using System;
using System.Collections.Generic;
using System.Linq;
using System.Web;
using System.Web.UI;
using System.Web.UI.WebControls;
using System.Data;
using System.Configuration;
using System.Data.SqlClient;
using System.IO;

public partial class Edit_Users : System.Web.UI.Page
{
    protected void Page_Load(object sender, EventArgs e)
    {
        if (!IsPostBack)
        {
            get_users();
        }
    }
    void get_users()
    {
        string users_id = Request.QueryString["id"].ToString();
        string koneksi_string = ConfigurationManager.ConnectionStrings["koneksi_material"].ConnectionString;
        SqlConnection koneksi = new SqlConnection(koneksi_string);
        koneksi.Open();
        SqlCommand cmd = new SqlCommand("select * from t_users where id='" + users_id + "'", koneksi);
        SqlDataReader data = cmd.ExecuteReader();

        while (data.Read())
        {
            txtID.Text = data["id"].ToString();
            txtUsername.Text = data["username"].ToString();
            txtPassword.Text = data["password"].ToString();
            txtEmail.Text = data["email"].ToString();
            txtNamaLengkap.Text = data["namalengkap"].ToString();
        }
    }
    protected void btnUpdate_Click(object sender, EventArgs e)
    {
        string koneksi_string = ConfigurationManager.ConnectionStrings["koneksi_material"].ConnectionString;
        SqlConnection koneksi = new SqlConnection(koneksi_string);
        koneksi.Open();
        SqlCommand cmd = new SqlCommand("update t_users set username = '" + txtUsername.Text + "', password = '" + txtPassword.Text + "', email = '" + txtEmail.Text + "', level = '" + cboLevel.Text + "', namalengkap = '" + txtNamaLengkap.Text + "' where id = '" + txtID.Text + "'", koneksi);
        cmd.ExecuteNonQuery();
        koneksi.Close();
        Response.Redirect("View_Users.aspx");
    }
}