僵尸惊情有第二部吗:ASP.NET数据更新问题

protected void Button1_Click(object sender, EventArgs e)
{ string username = (string)Session["username"];
OleDbConnection con = new OleDbConnection(ConfigurationManager.AppSettings["xy"]);
OleDbCommand cmd = new OleDbCommand("UPDATE YSB_user set password='"+TextBox2.Text+"' WHERE username="+username, con);
con.Open();
cmd.ExecuteNonQuery();
con.Close();
}

报错：
异常详细信息: System.Data.OleDb.OleDbException: UPDATE 语句的语法错误。

源错误:

行 25: OleDbCommand cmd = new OleDbCommand("UPDATE YSB_user set password='"+TextBox2.Text+"' WHERE username="+username, con);
行 26: con.Open();
行 27: cmd.ExecuteNonQuery();
行 28: con.Close();
行 29: }

请教原因。。谢谢~~
更改后同样报错

异常详细信息: System.Data.OleDb.OleDbException: UPDATE 语句的语法错误。

源错误:
行 25: OleDbCommand cmd = new OleDbCommand("UPDATE YSB_user set password='"+TextBox2.Text+"' WHERE username='"+username+"'", con);
行 26: con.Open();
行 27: cmd.ExecuteNonQuery();
行 28: con.Close();
行 29: }