insertCmd = "Insert Into medal(country，rank，gold_num，medal_num)Values('" + GetSqlStr(textBox1.Text) + "','" + GetSqlStr(textBox2.Text) + "'," + int.Parse(textBox3.Text) + "," + int.Parse(textBox4.Text);需要怎么修改

这个 SQL 语句的语法有问题，缺少右括号和分号。正确的语法应该是：

insertCmd = "INSERT INTO medal (country, rank, gold_num, medal_num) VALUES ('" + GetSqlStr(textBox1.Text) + "', '" + GetSqlStr(textBox2.Text) + "', " + int.Parse(textBox3.Text) + ", " + int.Parse(textBox4.Text) + ");";

此外，为了防止 SQL 注入攻击，建议使用参数化查询，而不是拼接字符串。例如：

insertCmd = "INSERT INTO medal (country, rank, gold_num, medal_num) VALUES (@country, @rank, @gold_num, @medal_num);";
SqlCommand cmd = new SqlCommand(insertCmd, conn);
cmd.Parameters.AddWithValue("@country", GetSqlStr(textBox1.Text));
cmd.Parameters.AddWithValue("@rank", GetSqlStr(textBox2.Text));
cmd.Parameters.AddWithValue("@gold_num", int.Parse(textBox3.Text));
cmd.Parameters.AddWithValue("@medal_num", int.Parse(textBox4.Text));

这样可以更安全地执行 SQL 查询。