1.what is wrong with the following code?

Two things you have to consider

• SqlInjection attack which you can refer from above answers
• you are using SqlCommand.ExecuteNonQuery [^] which will result only integer value indicating the no of rows affected where cannot show the details of customer in the gridview, you should use sqldataadapter[^] or SqlDataReader[^] to fetch the data and show it in the girdview

string connectionString = ConfigurationManager.ConnectionStrings["CustomerDB"].ConnectionString;
           using (SqlCommand cmd = new SqlCommand("SELECT * FROM Customers WHERE CustomerId = @customer"))
           {
               using (SqlConnection con = new SqlConnection(connectionString))
               {
                   cmd.Connection = con;
                   cmd.Parameters.Add("@customer", txtCustomerId.Text.Trim());
                   SqlDataAdapter da = new SqlDataAdapter(cmd);
                   DataTable dt = new DataTable();
                   da.Fill(dt);
                   CustomerGridView.DataSource = dt;
                   CustomerGridView.DataBind();

               }
           }

Since sqldataadapter[^] is a disconnected Architecture, No need to Open and close the connection manually. it will be taken care off. and since you are using SqlConnection under Using block, the close() part will be handled internally when the object gets disposed.

Your approach is wrong from the very beginning. The query composed by concatenation with strings taken from UI. Not only repeated string concatenation is inefficient (because strings are immutable; do I have to explain why it makes repeated concatenation bad?), but there is way more important issue: it opens the doors to a well-known exploit called SQL injection.

This is how it works: http://xkcd.com/327.

Are you getting the idea? The string taken from a control can be anything, including… a fragment of SQL code.

What to do? Just read about this problem and the main remedy: parametrized statements: http://en.wikipedia.org/wiki/SQL_injection.

With ADO.NET, use this: http://msdn.microsoft.com/en-us/library/ff648339.aspx.

Please see my past answers for some more detail:
EROR IN UPATE in com.ExecuteNonQuery();,
hi name is not displaying in name?.

See also (links provided by our member Richard Deeming:
Troy Hunt: Everything you wanted to know about SQL injection (but were afraid to ask),
How can I explain SQL injection without technical jargon? - Information Security Stack Exchange,
Query Parameterization Cheat Sheet — OWASP[^],
SQL injection attack mechanics | Pluralsight — YouTube.

—SA