Well, user is a keyword (If I'm not mistaken than it's a inbuilt table) in SQL, So you can't give a table name like that.
But still if you want to, you can, but write the query this way,
string query = "insert into [user] (username,password) values ('" + textBox1.Text + "','" + textBox2.Text + "')";
-KR