ASP.NET 修改密码代码

using System;
using System.Data;
using System.Configuration;
using System.Collections;
using System.Web;
using System.Web.Security;
using System.Web.UI;
using System.Web.UI.WebControls;
using System.Web.UI.WebControls.WebParts;
using System.Web.UI.HtmlControls;
using System.Data.SqlClient;

public partial class changepassword : System.Web.UI.Page
{
    protected void Page_Load(object sender, EventArgs e)
    {

    }
    protected void Button1_Click(object sender, EventArgs e)
    {
        //读取web.config配置文件数据库连接字符串
        string strConstring = ConfigurationManager.ConnectionStrings["ConnectionString"].ConnectionString;
        //创建sql数据库连接对象
        SqlConnection conn = new SqlConnection();
        conn.ConnectionString = strConstring;
        conn.Open();
        try
        {
            SqlCommand selectedcmd = new SqlCommand("select from users where userid='"+Session["userid"].ToString()+"'and password='"+origin.Text.Trim()+"'",conn);
            SqlDataReader sdr = selectedcmd.ExecuteReader();
            if (sdr.Read())
            {
                SqlCommand updatecmd = new SqlCommand("update users set password='" + newpwd.Text.Trim() + "'where userid='" + Session["userid"].ToString() + "'", conn);
                int i = updatecmd.ExecuteNonQuery();
                if (i == 1)
                {
                    Response.Write("<script language =javascript>alert('密码修改成功')</script>");
                }
                else
                {
                    Response.Write("<script language =javascript>alert('密码修改失败')</script>");
                }
            }
            else
            {
                Response.Write("<script language =javascript>alert('原密码错误')</script>");
 
            }
        }
        catch (System.Exception ee)
        {
            Response.Write("<script language =javascript>alert('" + ee.Message.ToString() + "')</script>");
        }
        finally
        {
            conn.Close();
        }
    }