我有一些问题，让插入字符串的工作，它给我一个语法错误，但不能找出原因，有帮助吗？

String sql = "INSERT INTO user VALUES ('"+ jtfEmailAddr.getText()+"'," + 
             "'"+ jtfPassword2.getText() + "'," + 
             "'"+ jtfFName.getText() +"','" + jtfSurname.getText() +"')" +
             "ON DUPLICATE KEY UPDATE password='" + jtfPassword2.getText() + "'"+ `enter code here`
             "firstname='" + jtfFName.getText() + "'," +
             "lastname='" + jtfSurname.getText() + "'";
database.insertIntoDatabase(sql);

错误：

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'rr'nn)' at line 1

字母rr nn只是随机的测试目的