代码如下：
SqlConnection con = db.createcon();
con.Open();
SqlCommand cmd = new SqlCommand("insert into user(userName,pwd,trueName) Values('" + this.txtName.Text + "','" + this.txtPwd.Text + "','" + this.txtTrueName.Text + "')", con);
cmd.ExecuteNonQuery();
con.Close();

调试提示说cmd.ExecuteNonQuery();有语法错误，请问该怎么写？