ExecuteReader: CommandText property has not been initialized

//code in DAL
public List<SignUp> getLogin() { List<SignUp> loginAccount = new List<SignUp>();
string username, password; string queryStr = null;
if (_username != "" && _password != "") queryStr = "SELECT * FROM SignUp WHERE Username = '%" + _username + "%' AND Password = '" + _password + "'";
SqlConnection conn = new SqlConnection(_connStr); SqlCommand cmd = new SqlCommand(queryStr, conn);
conn.Open(); SqlDataReader dr = cmd.ExecuteReader();  
while (dr.Read()) { username = dr["Username"].ToString(); password = dr["Password"].ToString();
loginAccount.Add(new SignUp(username,password)); }
conn.Close(); dr.Close(); dr.Dispose();
return loginAccount; }
//code in BLL
public List<SignUp> loginAc ...