Since you are using SQL, would recommend against using adhoc ('writing statements in strings'), especially given that you are loading an image.
ADO.NET can do all of the hard work of mapping, escaping etc for you.
Either create a Stored Procedure, or use SqlParameter to do the binding.
As the other posters say, use VARBINARY(MAX) as your storage type - IMAGE is being depracated.