What are the problems to construct SQL statement in the following way. (strID will be assigned user input value)

string strID;
:
:
string strSQL = “SELECT * From ItemMaster WHERE ID = ‘” + strID + “’”;