The @CustID means it's a parameter that you will supply a value for later in your code. This is the best way of protecting against SQL injection. Create your query using parameters, rather than concatenating strings and variables. The database engine puts the parameter value into where the placeholder is, and there is zero chance for SQL injection.
InfoQ: Microsoft Brings SQL to the Edge, Announces Azure SQL Database Edge
Houston Chronicle: How to Attach an SQL Database to a Web Page
SQL has dominated data querying for decades. Newer query languages offer more elegance, simplicity, and flexibility for modern use cases. For the last three decades, databases and Structured Query ...
I have seen SQL that uses both != and <> for not equal. What is the preferred syntax and why? I like !=, because <> reminds me of Visual Basic.
Should I use != or <> for not equal in T-SQL? - Stack Overflow
In SQL, anything you evaluate / compute with NULL results into UNKNOWN This is why SELECT * FROM MyTable WHERE MyColumn != NULL or SELECT * FROM MyTable WHERE MyColumn <> NULL gives you 0 results.
sql - Not equal <> != operator on NULL - Stack Overflow
Depending on the flavour of SQL you may need to tweak the casts on the order number to an INT or VARCHAR depending on whether implicit casts are supported. This is a very common technique in a WHERE clause. If you want to apply some "IF" logic in the WHERE clause all you need to do is add the extra condition with an boolean AND to the section where it needs to be applied.