asp.net(C#)写SQL语句技巧

/*添加SQL*/string fields = "";string values = "";fields += "xm"; values += "'" + Request.Form["xm"].ToString() + "'";fields += ",xb"; values += ",'" + Request.Form["xb"].ToString() + "'";fields += ",sfz"; values += ",'" + Request.Form["sfz"].ToString() + "'";fields += ",dzyj"; values += ",'" + Request.Form["dzyj"].ToString() + "'";sql = "insert into EKECMS_EKETEAM (" + fields + ") values (" + values + ")";

/*修改SQL*/sql = "updateEKECMS_EKETEAM set ZDMJ='" + Request.Form["h1"].ToString() + "'";sql += ",jglx='" + Request.Form["h2"].ToString() + "'";sql +=" where pid in (" + Request.Form["id"].ToString() + ")";