为啥读入数据库的是“SQL2”，而不是填入box里的值

为什么读入数据库的是“SQL2”，而不是填入box里的值
using (SqlConnection str1 = new SqlConnection("Data Source=(local);database=NewData;uid=sa;pwd=xitong"))
  { str1.Open();
  string SQL2 = this.tbBrand.Text;
   
  SqlCommand com = new SqlCommand();
  com.CommandText="insert into NVR(Brand) values ('SQL2')";
   
  com.Connection=str1;
  com.ExecuteNonQuery();
  str1.Close();
}

------解决方案--------------------------------------------------------
com.CommandText="insert into NVR(Brand) values ('"+SQL2+"')";
------解决方案--------------------------------------------------------
com.CommandText="insert into NVR(Brand) values ('"+SQL2+"')";
SQL2是变量，你当做字符串的值穿进去了