asp.net(C#)写SQL语句技巧

/*添加SQL*/
string fields = "";
string values = "";
fields += "xm"; values += "'" + Request.Form["xm"].ToString() + "'";
fields += ",xb"; values += ",'" + Request.Form["xb"].ToString() + "'";
fields += ",sfz"; values += ",'" + Request.Form["sfz"].ToString() + "'";
fields += ",dzyj"; values += ",'" + Request.Form["dzyj"].ToString() + "'";
sql = "insert into EKECMS_EKETEAM (" + fields + ") values (" + values + ")";

/*修改SQL*/
sql = "update EKECMS_EKETEAM set ZDMJ='" + Request.Form["h1"].ToString() + "'";
sql += ",jglx='" + Request.Form["h2"].ToString() + "'";
sql +=" where pid in (" + Request.Form["id"].ToString() + ")";