String   sql2="insert   into   user   values("+id+","+card_id+","+pass+","+address+","+phone+","+name+","+gender+","+email+")"; 变量已经是String乱而就不用刻意加'了吧
还有,你检查一下你得到的变量是不是中文字符啊,如果不是可以写成
String   id=new   String(request.getParameter("TxtUserID").trim().getBytes("ISO-8859-1"),"GB2312");