.ExecuteNonQuery() sql asp.net error -

this first time working sql , asp.net. working on few examples ensure have basics need. walking though tutorial , should working fine, getting .executenonquery() error. sqlexception unhandled user code // incorrect syntax near keyword 'table'.

if have pointers, let me know. worked tutorial twice, i'm sure i'm doing wrong here. -thanks

.cs code:

using system; using system.collections.generic; using system.linq; using system.web; using system.web.ui; using system.web.ui.webcontrols; using system.data.sqlclient; using system.configuration;  namespace website { public partial class _default : system.web.ui.page {     sqlconnection con = new sqlconnection(configurationmanager.connectionstrings["connectionstring"].connectionstring);      protected void page_load(object sender, eventargs e)     {         con.open();     }      protected void button1_click(object sender, eventargs e)     {         sqlcommand cmd = new sqlcommand("insert table values('" + txtfname.text + "','" + txtlname.text + "','" + txtpnumber.text + "')", con);         cmd.executenonquery();         con.close();         label1.visible = true;         label1.text = "your data has been submitted";         txtpnumber.text = "";         txtlname.text = "";         txtfname.text = "";     }   } } 

.aspx file:

<form id="form1" runat="server"> <div class="auto-style1">      <strong>insert data database<br />     <br />     </strong>  </div>     <table align="center" class="auto-style2">         <tr>             <td class="auto-style3">first name:</td>             <td class="auto-style4">                 <asp:textbox id="txtfname" runat="server" width="250px"></asp:textbox>             </td>         </tr>         <tr>             <td class="auto-style3">last name:</td>             <td class="auto-style4">                 <asp:textbox id="txtlname" runat="server" width="250px"></asp:textbox>             </td>         </tr>         <tr>             <td class="auto-style3">phone number:</td>             <td class="auto-style4">                 <asp:textbox id="txtpnumber" runat="server" width="250px"></asp:textbox>             </td>         </tr>         <tr>             <td class="auto-style3">&nbsp;</td>             <td class="auto-style4">                 <asp:button id="button1" runat="server" onclick="button1_click" text="submit" width="150px" />             </td>         </tr>     </table>     <br />     <br />     <asp:label id="label1" runat="server" forecolor="#663300" style="text-align: center" visible="false"></asp:label>     <br />     <asp:sqldatasource id="sqldatasource1" runat="server" connectionstring="<%$ connectionstrings:connectionstring %>" selectcommand="select * [table]"></asp:sqldatasource> </form> 

sql database:

create table [dbo].[table] ( [id]      int          identity (1, 1) not null, [fname]   varchar (50) not null, [lname]   varchar (50) not null, [pnumber] varchar (50) not null, primary key clustered ([id] asc) ); 

usually error message caused single quote present in input textboxes or use of reserved keyword. both problems present in query. table word reserved keyword sql server , should encapsulate square brackets, while possible presence of single quote in input text correct approach use parameterized query this

sqlcommand cmd = new sqlcommand("insert [table] values(@fnam, @lnam, @pnum)", con); cmd.parameters.addwithvalue("@fnam", txtfname.text ); cmd.parameters.addwithvalue("@lnam", txtlname.text ); cmd.parameters.addwithvalue("@pnum", txtpnumber.text); cmd.executenonquery(); 

with approach shift work parse input text framework code , avoid problems parsing text , sql injection

also, suggest not use global variable keep sqlconnection reference. expensive resource and, if forget close , dispose it, have significant impact on performance , stability of application.
kind of situations using statement need

using(sqlconnection con = new sqlconnection(configurationmanager.connectionstrings                              ["connectionstring"].connectionstring)); {     con.open();     sqlcommand cmd = new sqlcommand("insert [table] values(@fnam, @lnam, @pnum)", con);     cmd.parameters.addwithvalue("@fnam", txtfname.text );     cmd.parameters.addwithvalue("@lnam", txtlname.text );     cmd.parameters.addwithvalue("@pnum", txtpnumber.text);     cmd.executenonquery(); } 

of course remove global variable , open in page_load