Even if the ID variable is an integer (and therefore you're immune to injection), it's still inefficient. If you use the command "select * from Customer where ID=@id" and you set ID as a parameter instead, then caching can happen behind the scenes ("prepared statements").

See the justifications at https://www.npgsql.org/doc/basic-usage.html#parameters, for example. My experience is only with Postgres, but I imagine they translate.