What does the symbol do in SQL

Question

I was browsing through the questions and noticed this:

SELECT prodid, issue
FROM Sales 
WHERE custid = @custid 
AND datesold = SELECT MAX(datesold) 
             FROM Sales s 
             WHERE s.prodid = Sales.prodid
                  AND s.issue = Sales.issue
                  AND s.custid = @custid

What is the purpose of the "@" before custID, I wondered? Is it merely a method of referencing the custID from the specified table?

Answer 1

The @CustID denotes a parameter for which you will subsequently provide a value in your code. The most effective method of preventing SQL injection is this. Instead of concatenating strings and variables, construct your query using parameters. There is no potential for SQL injection because the database engine inserts the parameter value where the placeholder resides.

I hope this helps you.