Example of insecure of password check

gistfile1.cs

bool IsValidUser(string userName, string password)
{
   string sql = string.Format("SELECT 1 FROM person " + 
                              "WHERE userName = '{0}' AND password = '{1}'",
                              userName,
                              password);
   return ExecuteQuery(sql).Rows > 0;
}