I jumped the gun on this. If you can guarantee that $CustomerNumber will only hold digits, and CustomerNumber is a numeric field in the database, then don't quote it in the query.