c# - Is this a proper way of putting quotes in SQL query in ADO.NET -

string query = @"insert uczniowie (id, name, surname, age)" +                  "values('" + textbox1.text + "'" +                           ", '" + textbox2.text + "'" +                           ",'" + textbox3.text + "'" +                           ",'" + textbox3.text + "'"; 

no, it's not since it's open sql injection attack. rather use parameterized query like

string query = "insert uczniowie (id, name, surname, age) values(@id, @name, @surname, @age)"; 

see msdn documentation on how to: execute parameterized query more information on same