Is this piece of code OK?

At one of the job interviews I was asked this question for the following piece of code (see below). Few days ago I was putting my papers in order and found the sheet with the question. This code will compile and run, furthermore it will work as desired. But what’s wrong with it, however?

class BuildTable
    {
        public string BuildEmployeeTable(string lnamePrefix)
        {
            string cmd = "SELECT fname, lname, phone FROM Employee WHERE lname LIKE'" + lnamePrefix + "'";
            SqlConnection sqlConnection = new SqlConnection(ConfigurationSettings.AppSettings["ConnectionString"]);
            SqlCommand sqlCommand = new SqlCommand(cmd, sqlConnection);
            SqlDataReader sqlReader = sqlCommand.ExecuteReader();
            string empTable = "<TABLE BORDER=3><TR>";
            empTable = empTable + "<TH>Name</TH><TH>Phone</TH>";
            while (sqlReader.Read())
            {
                empTable = empTable + string.Format("<TR><TD>{0} {1}</TD><TD>{2}</TD></TR>",
                    sqlReader["fName"], sqlReader["lName"], sqlReader["phone"]);
            }
            empTable = empTable + "</TABLE>";
            sqlReader.Close();
            sqlConnection.Close();
            return empTable;
        }
    }