Dynamic SQL Scripts

SqlConnection sql =new SqlConnection("Server=(local); User id=sa; Password=sa; Database=Friends");
sql.Open();
string sadsoyad="koray",smeslek="bilgisayar",yer="......",mail="i@",tel="2143234";
string sdogum="12.12.1987";
string id=textBox1.Text;
Dataset1 dataSet1=new Dataset1();
string sorgu="UPDATE ";
string tabloAd=dataSet1.Tables[1].TableName;
string set1=" SET";
string where=" WHERE ";
string update=" adSoyad='"+sadsoyad+"',meslek='"+smeslek+"',dogumTarihi='"+sdogum+"',yasadigiYer='"+yer+"',eMail='"+mail+"',telefon='"+tel+"' ";
string edilecek=" adSoyad='"+sadsoyad+"' ";
sorgu+=tabloAd;
sorgu+=set1;
sorgu+=update;
sorgu+=where;
sorgu+=edilecek;

textBox2.Text=sorgu ;
SqlCommand komut=new SqlCommand(sorgu,sql);
komut.ExecuteNonQuery();
sql.Close();
-------------------------------------------------------------------------------------------

SqlConnection sql=new SqlConnection("Server=(local); User id=sa; Password=sa; Database=Friends");
sql.Open();
Dataset1 ds=new Dataset1();
string adsoyad,meslek,yer,mail,tel,dogum;
adsoyad=textBox3.Text ;
meslek=textBox4.Text;
dogum="12.12.1985";
yer=textBox5.Text;
mail=textBox6.Text;
tel=textBox7.Text;
string sorgu="INSERT INTO ";
string tabloAd=ds.Tables[1].TableName;
sorgu+=tabloAd;
string ekle="(adsoyad,meslek,dogumTarihi,yasadigiYer,eMail,telefon)";
sorgu+=ekle;
string values=" VALUES ";
sorgu+=values;
string deger="('"+adsoyad+"','"+meslek+"','"+dogum+"','"+yer+"','"+mail+"','"+tel+"')";
sorgu+=deger;
listBox1.Items.Add(sorgu);


SqlCommand komutt=new SqlCommand(sorgu,sql);
komutt.ExecuteNonQuery();
sql.Close();