My bad! it was late... quotes are all there:

set @sql = 'create login ' + @ip_newuser + ' with password = ''password'' ' ;

exec (@sql);

for testing purposes...