Query For Report, & Query for Insert, Update & SQL Store Procedure

Query For  Report:

SELECT        Patient_Visit.Patient_Id, Patient_Visit.Surname, Patient_Visit.Firstname, Patient_Visit.Middlename, Patient_Visit.Sex, Patient_Visit.Contact_no,
                         Patient_Details.Date_of_visit, Patient_Details.Date_of_discharge, Patient_Details.Symptoms, Patient_Details.Disease, Patient_Details.Treatment,
                         Patient_Details.DoctorName, Patient_Details.Age, Patient_Details.Occupation, Patient_Details.Sensitivity, Patient_Details.MentalStatus,
                         Patient_Details.sleep, Patient_Details.Nutrition, Patient_Details.Vitality, Patient_Details.PhysicalStatus, Patient_Details.Nature,
                         Patient_Details.Proving, Patient_Details.RemedySource, Patient_Details.Remedytype

FROM            (Patient_Details LEFT OUTER JOIN
                         Patient_Visit ON Patient_Details.Patient_Id = Patient_Visit.Patient_Id)
WHERE        (Patient_Details.Patient_Id = @ Patient_Id)

--------------------------------------------------------------------
Query for Indesert & Update

Insert---------->

string query = " insert into UserInformation(Title,FirstName,MiddleName,LastName,Age,DateOfBirth,Status,Category,Sex)values(" + Title + "," + FirstName + "," + MiddleName + "," + LastName + "," + Age + "," + DateOfBirth + "," + Status + "," + Category + ","+Sex+")";



Update----------->

 String query = "Update from UserInformation set Title,FirstName,MiddleName,LastName,Age,Category,status,DateOfBirth,Sex='" + Title + "','" + FirstName + "','" + MiddleName + "','" + LastName + "','" + Age + "','" + Category + "','" + Status + "','" + DateOfBirth + "','" + Sex + "'  where UserId='" + UserId + "'";

-------------------------------------

______________________________________________
Code At DAL using Store Procedure:
   
public string AddNewUsersInform()
     
{
         
SqlConnection conn = new SqlConnection(Settings.ConnectionString);

 SqlCommand cmd = new SqlCommand();
         
 cmd.Connection = conn;
         
cmd.CommandText = "uspAddNewUserInformation";
         
 cmd.CommandType = CommandType.StoredProcedure;
         
 cmd.Parameters.AddWithValue("@FirstName", FirstName);
         
 cmd.Parameters.AddWithValue("@MiddleName", MiddleName);
         
 cmd.Parameters.AddWithValue("@LastName", LastName);
         
cmd.Parameters.AddWithValue("@Age", Age);
         
cmd.Parameters.AddWithValue("@DateOfBirth", DateOfBirth);
         
cmd.Parameters.AddWithValue("@Sex", Sex);
       
  cmd.Parameters.AddWithValue("@Category", Category);

         
 string result = cmd.ExecuteScalar().ToString();
       
  return result;
     

 }