asp.net登录代码

protected void lkbtLogin_Click(object sender, System.EventArgs e)
{
if(txtVerifyNum.Text.Trim() != Session["SessionAppendNumber"].ToString())
{
oprtb.AlertMsg("输入的验证码错误",Page);
return;
}

DataSet ds = new DataSet();
string sql = "select UserID,Name,DepartID,CompanyID,";
sql = sql+"(select Name from Depart where ((DepartID=UserList.DepartID) and ( CompanyID=UserList.CompanyID))) as DepartName,";
sql = sql+"(select Name from Company where (CompanyID=UserList.CompanyID)) as CompanyName ";
sql = sql+"from UserList where UserID='" + txtUserID.Text.Trim() +"' and Password='" + Encrypt.EncryptPwd(txtPassword.Text.Trim(),"MD5") + "' and Cancellation = 0";

//string sql = "select * from UserList where UserID='" + txtUserID.Text.Trim() +"' and Password=&