That sort of unparameterized inline sql will make you a sitting duck
for SQL injection attacks. Consider using something like this:
cmd.CommandText = "Insert into tb1 (col1, col2, col3) values (@col1, @col2, @col3); Insert into tb2 (col1, col2, col3) values (@col11, @col12, @col13);";
cmd.Parameters.AddWithValue("col1",
"val1");
cmd.Parameters.AddWithValue("col2",
"val2");
cmd.Parameters.AddWithValue("col3",
"val3");
cmd.Parameters.AddWithValue("col11",
"val4"); cmd.Parameters.AddWithValue("col12",
"val5");
cmd.Parameters.AddWithValue("col13",
"val6");