vs2008 c# 对sql插入操作

private void button1_Click(object sender, EventArgs e)        {            string sqlCon = "server=(local);uid=sa;pwd=sa;database =Store";            string sql = "Insert into  GoodsTable(GoodsNumber, GoodsName,GoodsType)Values( '" + textBox1.Text + "','" + textBox2.Text + "','" + textBox3.Text + "')";            SqlConnection conn = new SqlConnection(sqlCon);            SqlCommand cmd = new SqlCommand(sqlCon, conn);            //cmd.CommandText =sql;            //cmd.Connection=conn.Connection;            conn.Open();            int val = cmd.ExecuteNonQuery();            if (val >= 1)            {                MessageBox.Show("添加成功！", "提示", MessageBoxButtons.OK, MessageBoxIcon.Information);            }            else            {                MessageBox.Show("请正确输入！", "警告", MessageBoxButtons.OK, MessageBoxIcon.Warning);            }            conn.Close();        }