在ASP.NET中，向SQL更新数据的问题

Question

cmdGetAll = new SqlCommand();
cmdGetAll.Connection = cnDataTable;
string command = "update Login set password='"+password+"',TrueName='"+TrueName+"',Email='"+Email+"',Telephone='"+Telephone+"',Sex='"+Sex+"',Oicq='"+Oicq+"',HomePage='"+HomePage+"',address='"+Address+"',JieShao='"+JieShao+"' where (name='"+name+"')";
cmdGetAll.CommandType = CommandType.Text;try
{
        cnDataTable.Open();
       cmdGetAll = new SqlCommand(command,cnDataTable);
       int i = cmdGetAll.ExecuteNonQuery();
      Response.Write(i);
     Response.Redirect("Success.aspx");
}
catch(SqlException ex)
{
       Response.Write(ex.Message);
}
finally
{
       cnDataTable.Close();
}

Answer 1

update Login set [password]='"+password+"'.....