Update Query in Windows Forms

string query1 = "update YEARMASTER set FromYear = '" + ff + "',ToYear = '" + tt + "',AccountYear = '" + accyear + "' where Year_Code = '" + yid + "'";
                        SqlCommand cmd1 = new SqlCommand(query1, con);
                        cmd1.ExecuteNonQuery();
                        MessageBox.Show("Updated Successfully");