It appears that 2 problems are trying to be solved here:

#1 - How to deal with dynamic SQL.

#2 - How to apply the proper protection from SQL injection.

SP's are useful...