How to write a stable WCF service
You should never generate dynamic SQL by concatenating incoming values into an SQL string that is executed later. This type of code leads to SQL injection vulnerability, and by using your service as it is now it's very easy to get access to any user account without knowing its password.

If you plan to develop your service further take your time to learn one of the ORM frameworks (Entity Framework, NHibernate, or maybe one of the NoSQLs like MongoDB or RavenDB) and get rid of low-level DB management code from your service. Alternatively (if you prefer inventing a wheel :)) move DB-related code to separated class and name it "DB repository" so that your service doesn't have too many responsibilities (currently it has business logic responsibilities combined with DB access management).

About exception handling - here is a good article that describes what you should and should not do. Basically you should only catch specific exceptions, and only if you know how to recover from that exception in a meaningful way, that doesn't leave your application in an inconsistent state. In case when WCF service has no way to return a meaningful response (e.g. when response is based on DB data and database is not available) you should pass exception to the client. 

And finally, store your connection strings in the configuration files rather than hardcoded.