sql注入 - .NET技术 / C#

我写了一个用户注册后数据存入数据库，可是就是存不进去
下面是代码：string sql = "";
  用户 user = new 用户();
  user.Name = textBox1.Text;
  user.MiMa = textBox2.Text;
  user.QMiMa = textBox3.Text;
  user.Sex = comboBox1.Text;
  user.Age = Convert.ToInt16(textBox4.Text);
  if (user.Name != null)
  {
  if (user.MiMa != null)
  {
  if (user.MiMa == user.QMiMa)
  {
  sql = "insert into user(用户名,密码,年龄,性别) values ('" + textBox1.Text + "'," + Convert.ToInt16(textBox2.Text) + "," + Convert.ToInt16(textBox4.Text) + ",'" + comboBox1.Text + "')";


   
   
  OleDbCommand command = new OleDbCommand(sql,con );
  con.Open();
  int num = Convert.ToInt32(command.ExecuteNonQuery());
  if (num == 1)
  {

  this.Close();
  }