Help Creating a secure login form

Well, I've been making a program that requires login usage, before being able to access everything, only problem is, that the program doesn't like to do what its told...Here's what I have so far: (Note, I use SQL Compact, not access or mysql, so don't give me help for those databases...I don't want those.)

Code:

    Private Sub OK_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles OK.Click
        Dim dr As SqlCeDataReader = cmd.ExecuteReader
        cmd = New SqlCeCommand("SELECT Username,Password FROM users WHERE Username ='" & txtUser.Text & "' AND Password ='" & getMD5Hash(txtPassword.Text) & "')", con)
        con.Open()
        cmd.ExecuteNonQuery()
        Try
        Catch ex As InvalidOperationException
            MsgBox(ex.Message)
        End Try
        Try
            If dr.Read = False Then
                MessageBox.Show("Authentication Failed...")
            Else
                MessageBox.Show("Login Successful...")
            End If
        Catch ex As Exception
            MsgBox(ex.Message)

        End Try
        If con.State <> ConnectionState.Closed Then
            con.Close()
        End If
    End Sub

The Declaration Codes are up towards the top of the code, in a Public Sub. Here is my error:

Code:

"Object reference not set to an instance of an object."

I can't make heads or tails of this. I worked on this form for 2 whole days, and haven't figured out what makes it do that. I just got done solving why it didn't do the sql right...but now, this is starting to annoy me =/

Help would be wonderful.