.NET数据连接和用户验证函数

using System;
using System.Collections.Generic;
using System.Linq;
using System.Web;
using System.Web.Configuration;
using System.Data.Sql;
using System.Data.SqlClient;
/// <summary>
///连接数据库
/// </summary>
public class ConnectionDB
{
//连接字符串
protected static string connectionString = WebConfigurationManager.ConnectionStrings["userConnectionString"].ConnectionString;
public ConnectionDB()
{

}
/// <summary>
/// 执行查询语句返回SqlDataReader
/// </summary>
/// <param name="connectionStr">SQL查询语句</param>
/// <returns>SqlDataReader</returns>
public static SqlDataReader ExecuteReade(string connectionStr)
{
SqlConnection con = new SqlConnection(connectionString);
SqlCommand cmd = new SqlCommand(connectionStr, con);
con.Open();
SqlDataReader reader = cmd.ExecuteReader();
try
{
return reader;
}
catch (System.Data.SqlClient.SqlException e)
{

throw new Exception(e.Message);
}

}
/// <summary>
/// 判断用户名密码
/// </summary>
/// <param name="UserID">用户名</param>
/// <param name="Psd">密码</param>
/// <returns>bool</returns>
public static bool ValidationUser(string UserID, string Psd)
{
string MD5Psd = System.Web.Security.FormsAuthentication.HashPasswordForStoringInConfigFile(Psd, "MD5");
string sqlStr = "select [Name] from [userName] where Name='"+UserID+"'and Psw='"+MD5Psd+"'";
SqlDataReader reader = ExecuteReade(sqlStr);

//SqlCommand cmd= ConnectionDB.ExecuteReade(sqlStr);
//cmd.Parameters.AddWithValue("@UserID", @UserID);
//cmd.Parameters.AddWithValue("@Psd", @Psd);
//SqlDataReader reader = cmd.ExecuteReader();
reader.Read();
return reader.HasRows;
}
}