SQL连接字符串

大家来讨论下这样连接SQL数据库的弊端：

        /// <summary>
        /// 连接SQL数据库
        /// </summary>
        /// <param name="services">数据库服务器</param>
        /// <param name="sqluser">用户名</param>
        /// <param name="sqlpwd">密码</param>
        /// <returns></returns>
        public static string connection(string services, string sqluser, string sqlpwd)
        {
            return "Data Source=" + services + ";User ID=" + sqluser + ";Password=" + sqlpwd + "";
        }


        /// <summary>
        /// SQL连接字符串
        /// </summary>
        /// <param name="services">数据库服务器</param>
        /// <param name="sqluser">用户名</param>
        /// <param name="sqlpwd">密码</param>
        /// <param name="databases">数据库名</param>
        /// <returns></returns>
        public static string connection(string services, string sqluser, string sqlpwd, string databases)
        {
            return "Data Source=" + services + ";Initial Catalog=" + databases + ";User ID=" + sqluser + ";Password=" + sqlpwd + "";
        }