There are numerous things wrong with this block of code:
The application is not layered correctly.
Entity names should reflect the entity, nothing more (drop the "Data" off of "ProductData"; rename "Product" to "Products").
A glaring SQL injection vulnerability is present (as mentioned by PlausiblyDamp).
No validation is done at the property accessor level. You could easily set "ProductPrice" to -5, which makes little to no sense.
Property names on business objects shouldn't include the name of the business object (change "ProductID" to "ID", etc.).
Unnecessary unboxing is performed on the database fields.
The collections are not strongly typed.
The readers are never closed.