You can form final version of sql string based on if condition, i.e. if @forename is not null

sql = sql +...

Square brackets are used to make DBMS understand that do not treat the word as reserved word used by DBMS, if it is a SQL reserved word.