例如：

using (sqlCommand cmd = new sqlCommand("INSERT INTO [User] values (@Forename,@Surname,@Username,@Password)",con))
{
    cmd.Parameters.AddWithValue("@Forename",txtForename.Text);
    cmd.Parameters.AddWithValue("@Surname",txtSurname.Text);
    cmd.Parameters.AddWithValue("@UserName",txtUsername.Text);
    cmd.Parameters.AddWithValue("@Password",txtPassword.Text);

    cmd.ExecuteNonQuery();
}