C# Console MySQL Connection

        public static void prihlaseni()
        {           
            
            try
            {              
                MySqlConnection con = new MySqlConnection(str);
                con.Open();
                        
                String select_user = "SELECT username FROM casino_account WHERE username='"+Hlavni_Soubor.uzivatel+"';";
                String select_password = "SELECT password FROM casino_account WHERE password='"+Hlavni_Soubor.heslo+"'";
                MySqlCommand select_usr = new MySqlCommand(select_user, con);
                string db_select_usr = Convert.ToString(select_usr.ExecuteReader());
                con.Close();

                con.Open();
                MySqlCommand select_pass = new MySqlCommand(select_password, con);
                string db_select_pass = Convert.ToString(select_pass.ExecuteReader());
                con.Close();


                Console.WriteLine(db_select_pass + " +++ " + db_select_usr);
                Thread.Sleep(5000);
            }
            catch (MySqlException errorX)
            {
                Console.WriteLine("Error: " + errorX.ToString());
            }           
        }

Nevím, proč mi to nedokáže selectnout to "username a password", místo hodnot z DB to v Consoli napíše:

MySql.Data.MySqlClient.MySqlDataReader +++ MySql.Data.MySqlClient.MySqlDataReader

string db_select_usr = (string)select_usr.ExecuteScalar();

A zjisti si, co je SQL Injection.