我要把用户注册信息写进数据库，请问大家怎么写？
我这样写对吗？


SqlConnection con = db.createcon();
con.Open();
SqlCommand cmd = new SqlCommand("insert into [user](userName,pwd,trueName,sex,birth,pro,city,tel,email,code,personlike,images) Values('" + this.txtZhcName.Text + "','" + this.txtPwd.Text + "','" + this.txtTrueName.Text + "','" + this.RadioButtonListdsex.SelectedValue + "','" + this.txtBirth.Text + "','" + this.DdlPro.SelectedValue + "','" + this.DdlCity.SelectedValue.ToString + "','" + this.txtTel.Text + "','" + this.txtEmail.Text + "'.'" + this.txtCode.Text + "','" + this.CCblLike.SelectedValue + "','" + this.Image1.ImageUrl + "')", con);
cmd.ExecuteNonQuery();
con.Close();

运行出错，请大家帮我看一下怎么写？注册信息里包括文字，数字，还有图片，这在创建数据库的时候又怎么设置？

新手多指教， 谢谢！！