c# - SqlCommand insertion query -

i have execute query of insertion in c# code

connexion = new sqlconnection(connexionstring);              connexion.open();             list<int> liste = client.getidfichiers(1210);             int = 2;             foreach (int idfichier in liste)             {                 a++;                 using (connexion)                 {                   using (sqlcommand sqlcmd = new sqlcommand("insert rel_fab3dlotfichier_fichier3d (idrel_fab3dlotfichier_fichier3d,idfichier3d,idfab3dlotfichier,creepar,creele,modifiepar,datemaj,estactif) values (" + + "," + idfichier + "," + 17965 + "," + null + "," + null + "," + null + "," + null + "," + 1 + ")", connexion))                     {                         try                         {                             sqlcmd.executenonquery();                         }                         catch (exception ex) { messagebox.show(ex.tostring()); }                      }                 }              } 

the insertion isn't working , don't know why. selection , delete queries worked fine. when try insert values syntaxic error appears.

• what syntax error?
• how can fix it?

some of values passing may string/varchar objects , aren't wrapping them quotes:

new sqlcommand("insert rel_fab3dlotfichier_fichier3d (idrel_fab3dlotfichier_fichier3d,idfichier3d) values ('" + + "', '" + idfichier + "')", connexion); 

really, avd suggested, should use parameterisation, less prone injection attacks.