ASP.NET

[HttpPost]
        [AllowAnonymous]
        [ValidateAntiForgeryToken]
        public ActionResult Contact(ContactModel model, string returnUrl)
         {
             if (ModelState.IsValid && true == ContactExtender.SubmitContactMessage(model))
             {
                 // Package the data needed to send the message.
                 model.smtp_websiteName = "xxxxxx";
                 model.smtp_subject = "Contact Us";
                 model.smtp_sentFrom = "xxxxxx";
                 model.smtp_sendto = "xxxxxx";
                 model.smtp_replyto = "xxxxx";
                 model.smtp_templatePath_website = System.Web.Hosting.HostingEnvironment.MapPath("~/App_Data/SMTP_Templates/contact_website_template.html");
                 model.smtp_templatePath_customer = System.Web.Hosting.HostingEnvironment.MapPath("~/App_Data/SMTP_Templates/contact_customer_template.html");

                 // Send a email message to me and the customer.
                 bool website = Contact_Website_Email_Proc.Send_XHTML_Website_Message(model);
                 bool visitor = Contact_Customer_Email_Proc.Send_XHTML_Customer_Message(model);

                 ViewData["contactMessage"] = "Success";
                 //return RedirectToLocal(returnUrl);
             }
             else
             {
                 ViewData["contactMessage"] = "Failed";
                
             }
             return View(model);
        }

public static bool SubmitContactMessage(ContactModel  cm)
        {
            bool success = false;
            string connStr = ConfigurationManager.ConnectionStrings["DefaultConnection"].ConnectionString;
            SqlConnection conn = new SqlConnection(connStr);

            string query =
            "INSERT INTO CRM_MESSAGES " +
            "( " +
            "   Name " +
            "   , Subject " +
            "   , CompanyName " +
            "   , EmailAddress " +
            "   , Query " +
            "   , Date " +
            "   , MailingList " +
            ") " +
            "VALUES " +
            "( " +
            "   @Name " +
            "   , @Subject " +
            "   , @CompanyName " +
            "   , @EmailAddress " +
            "   , @Query " +
            "   , @Date " +
            "   , @MailingList " +
            ") ";            

            SqlCommand cmd = new SqlCommand(query, conn);

            cmd.Parameters.Add(new SqlParameter("@Name", cm.Name));
            cmd.Parameters.Add(new SqlParameter("@Subject", "ContactUs"));
            cmd.Parameters.Add(new SqlParameter("@CompanyName", cm.CompanyName));
            cmd.Parameters.Add(new SqlParameter("@EmailAddress", cm.EmailAddress));
            cmd.Parameters.Add(new SqlParameter("@Query", cm.Query));
            cmd.Parameters.Add(new SqlParameter("@Date", DateTime.Now));
            cmd.Parameters.Add(new SqlParameter("@MailingList", cm.MailingList));

            try
            {
                conn.Open();
                cmd.ExecuteNonQuery();                
                success = true;



            }
            catch (Exception)
            {
                success = false;
            }
            finally
            {
                conn.Close();

            }

            return success;
        }