don't use string concatenation to produce sql, you can use sp_executesql system stored prcedure to execute sql statement with parameters
create procedure getdata @ID int, @frm varchar(250), @to varchar(250) as
begin
declare @sql nvarchar(max), @paramDefs nvarchar(max);
set nocount on;
set @sql = N'select EmpName, Address, Salary from Emp_Tb where @id is null or Emp_Id_Pk = @id';
set @paramDefs = N'@id int';
execute sp_executesql @sql, @paramDefs, @id = @ID;
end
see sp_executesql