C# 访问数据库

select:

string m_sfzh = TxtBoxSfz.Text.ToString();
        string constr = ConfigurationManager.ConnectionStrings["NcreUtilsConnectionString"].ConnectionString;
        SqlConnection con = new SqlConnection(constr);
        if (con.State != ConnectionState.Open)
        {
            con.Open();
        }
        SqlCommand datacommand1 = new SqlCommand("select * from T_Zkzxx where SFZH = '" + m_sfzh + "'", con);
        //string sqlstr = "select * from T_Zkzxx where SFZH = '" + m_sfzh + "'";
        //string sqlstr = "select * from T_Zkzxx";
        //SqlCommand datacommand1 = new SqlCommand();
        //datacommand1.Connection = con;

        //datacommand1.CommandText = sqlstr;

        DataTable dt1 = new DataTable();
        dt1.Load(datacommand1.ExecuteReader());
        GridViewYzkzh.DataSource = dt1;
        GridViewYzkzh.DataBind();
        con.Close();

insert:

string Lsh = TxtBox_Lsh.Text.ToString();
        string Sfzh = TxtBox_SFZH.Text.ToString();
        int Xgxxzl = DrpLst_Xxzl.SelectedIndex;
        string Yxx = TxtBox_Yxx.Text.ToString();
        string Xgxx = TxtBox_Xgxx.Text.ToString();
        string constr = ConfigurationManager.ConnectionStrings["NcreUtilsConnectionString"].ConnectionString;
        //SqlConnection con = new SqlConnection("Data Source=SWJTU-EB81DB430\\SWJTUCJY;Initial Catalog=xiaokaocj;Integrated Security=True");
        SqlConnection con = new SqlConnection(constr);
        con.Open();
        SqlCommand cmd = new SqlCommand("insert into T_Bmxxxg values('"+Lsh+"','"+Sfzh+"',"+Xgxxzl+",'"+Yxx+"','"+Xgxx+"',getdate())", con);
        cmd.ExecuteNonQuery();
        con.Close();
        foreach (object obj in yourformID.Controls)
        {
            if (obj is TextBox)
            {
                TextBox tb = (TextBox)obj;
                tb.Text = "";
            }

        }
        Response.Write("<script>alert('信息修改成功');</script>;");
        //Response.Redirect("Bmxxxg.aspx");