try
                {
                    con.Open();
                    com = new SqlCommand("select a,b from 个人资料 where  a=@a and b=@b", con);
                    com.Parameters.Add("@a", SqlDbType.NVarChar, 50);
                    com.Parameters.Add("@b", SqlDbType.NVarChar, 50);
                    com.Parameters["@a"].Value = txtUser.Text;
                    com.Parameters["@b"].Value = txtPwd.Text;
                    SqlDataReader reader = com.ExecuteReader();
                    if (reader.Read())
                    {

                        ....                    }
                                       con.Close();
                }
                catch (Exception exx)
                {

                }
                finally
                {
                    con.Close();
                }