在ASP.NET中将用户注册信息插入数据库

public int CreateUser(User user) { string SQL_QUERY=" Select * From [User] Where LoginName='"+user.LoginName+"'"; using(OleDbConnection conn = GetOleDbConnection()) { OleDbCommand cmd = new OleDbCommand(SQL_QUERY, conn ); conn.Open(); using(IDataReader dr=cmd.ExecuteReader()) { if(dr.Read()) { return -1; } } SQL_QUERY="INSERT INTO [User] ([LoginName],[Password],[GradeId],[Email],[Sex],[Birthday],[Country],[Province],[City],[TrueName],[Address],[ZipCode],[Phone],[OnlineTool],[Account],[RegisterTime],[LastLoginTime],[LastLoginIP],[LoginCount],[Question],[Answer],[State])Values('"+user.LoginName+"','"+user.Password+"',"+user.GradeId+",'"+user.Email+"',"+user.Sex+",'"+user.Birthday+"','"+user.Country+"','"+user.Province+"','"+user.City+"','"+user.TrueName+"','"+user.Address+"','"+user.ZipCode+"','"+user.Phone+"','"+user.OnlineTool+"',"+user.Account+",'"+user.RegisterTime+"','"+user.LastLoginTime+"','"+user.LastLoginIP+"',"+user.LoginCount+",'"+user.Question+"','"+user.Answer+"',"+user.State+")"; cmd.CommandText = SQL_QUERY; if(cmd.ExecuteNonQuery()>0) { cmd.CommandText = "Select @@Identity"; return (int)cmd.ExecuteScalar(); //返回新增ID } else { return 0;//返回状态