帮忙看下这个方法有什么不对劲么？

C# code

        public OAUsers UpdateStateByUserName(string where)        {            try            {                StringBuilder strSql = new StringBuilder();                strSql.Append("update OAUser set");                strSql.Append(" state=1");                if (where.Trim() != null)                {                    strSql.Append(" where username=@username");                }                SqlParameter[] para =                                  {                                   new SqlParameter("@username",SqlDbType.NVarChar,50)                                  };                OAUsers use = new OAUsers();                para[0].Value = use.Username;                int res = DbHelperSQL.ExecuteSql(strSql.ToString(), para);                if (res > 0)                {                    return use;                }                else                {                    return null;                }            }            catch (Exception ex)            {                                throw new Exception(ex.ToString());            }        }