Insert Command in Windows Form

string query = "insert into YEARMASTER(FromYear,ToYear,AccountYear) values('" + ff + "','" + tt + "','" + accyear + "')";
                            SqlCommand cmd = new SqlCommand(query, con);
                            cmd.ExecuteNonQuery();
                            MessageBox.Show("Saved Successfully");