你可以将其写成一个带参数的sqlcommand啊,然后用sqlcommand添加参数,并赋值,最后运行就行了,要不就用拼凑的
string sql = "insert into [User](UserName,PassWord,RoleID,RealName,IDCardNumber,Telephone,[E-mail]) select UserName,PassWord,RoleID,RealName,IDCardNumber,Telephone,[E-mail] from [UserSH] where id=‘“+id+”’"