Use string Format when executing the Insert statement

SqlConnection conn = new SqlConnection ("server = login; integrated security = sspi; database = library ");
SqlCommand cmd;
Private void btninsert_Click (object sender, EventArgs e)
{
Conn. Open ();
String _ SQL = "insert into login values ('{0}', '{1}', '{2 }')";

/*
Format method:
①. String. Format (string format, object arg0 );
② String. Format (string format, params object [] args );
③ String. Format (IFormatProvider provider, string format, params object [] args );
④ String. Format (string format, object arg0, object arg1, object arg2 );
*/

// ④: String. Format (string format, object arg0, object arg1, object arg2 );
_ SQL = string. format (_ SQL, this. textBox1.Text. toString (). trim (), this. textBox2.Text. toString (). trim (), this. textBox3.Text. toString (). trim ());

/*
②: String. Format (string format, params object [] args );
Object [] aa = new object [] {'A', 'B', 'C', 'D', 'E '};
_ SQL = string. Format (_ SQL, AA );
*/
Cmd = new sqlcommand (_ SQL, Conn );
Cmd. executenonquery ();
Conn. Close ();
MessageBox. Show ("insert the values successfully! ");
}