Class & method in C#, is this a good approach?

public submitData()
{
//Onclick button
User user = new User();
user.Name = Name.Text;
user.Surname = Surname.Text;
 
UserData userD = new UserData();
object obj = userD.Insert(user); 
}
protected button_OnClick(object sender, EventArgs e)
{
 submitData();
}

public static bool Insert(User user, out int userID)
{
    userID =-1;
    using (SqlConnection conn = new SqlConnection(Data.GetConn()))
    {           
        using (SqlCommand cmd = conn.CreateCommand())
        {
            cmd.CommandText = "INSERT INTO Users (Name,Surname) VALUES (@Name,@Surname) SELECT SCOPE_IDENTITY() as UserID";

            if (conn.State == ConnectionState.Closed)
                conn.Open();

            cmd.Parameters.AddWithValue("@Name", user.Name);
            cmd.Parameters.AddWithValue("@Surname", user.Surname);                                                                                                                      
            var obj = cmd.ExecuteScalar();  
            if(obj!=null && int.TryParse(obj.ToString(), out  userID)
            {
                return true;
            }                  
        }            
    }
    return false;

}

int id;
if(!UserData.Insert(user, out id)) // since i have mark the method as static you don't need to create instance to call the method
{
   // error inserting user data, show alert to user 
}else
{
   //insert success , do something with user id 
}

• Parameterised query! Thank you for not making me get my SQL injection rant out and for knowing what you're doing :)
• Separation of data model and database access logic. Although V has suggested he wouldn't do it that way, I definitely encourage it.
• Checking whether the insert succeeds

• Can you use a pre-cooked entity mapping framework (e.g. Entity Framework or NHibernate)? Making a good and robust database access layer can take a reasonable amount of time and effort. It is sometimes the correct decision (I've done it on a project) depending on the database structure but not that often, imo.
• Your return type shouldn't be object, as DamithSL points out. It should be a bool saying whether the insert succeeds. Alternatively, throw an exception if it didn't.
• You will currently have to write INSERT and UPDATE functions manually for every data type. Consider using reflection (with PropertyInfos cached) to determine the values and column names for each object (see below for a sketch).
• You aren't associating the retrieved ID with the object, so it will be difficult to UPDATE (save) it later.

public static bool Insert<T>(string tableName, T user) where T : IIdentifiable
{
    using (SqlConnection conn = new SqlConnection(Data.GetConn()))
    {           
        using (SqlCommand cmd = conn.CreateCommand())
        {
            PropertyInfo[] properties = typeof(T).GetProperties(); // Actually, cache this, when you do it for real
            IList<string> propertyNames = properties.Select(p => p.Name).Where(n => n != "ID").ToList();
            cmd.CommandText = "INSERT INTO " + tableName + " (" + string.Join(",", propertyNames) + ") VALUES (@" + string.Join(",@", propertyNames) + ") SELECT SCOPE_IDENTITY() as NewRecordID";
 
            if (conn.State == ConnectionState.Closed)
                conn.Open();
 
            foreach(PropertyInfo property in properties)
              cmd.Parameters.AddWithValue("@" + property.Name, property.GetValue(user, null));

            var obj = cmd.ExecuteScalar();  
            int newId;
            if(obj!=null && int.TryParse(obj.ToString(), out newId)
            {
                user.ID = newId;
                return true;
            }                  
        }            
    }
    return false;

public interface IIdentifiable {
 int ID { get; set; }
}

public class User: IIdentifiable {
 public int ID { get; set; }
 public string Name { get; set; }
 public string Surname { get; set; } 
}