Ad-hoc queries give you flexibility in your application logic, but you almost always pay a price on performance.
If you are concerned with performance, I'd probably agree with your friend that you should look into stored procs, or some more static form of query, to allow the database to "pre-optimize" the query, or allow the caching layer (if one exists) to potentially cache query results.
If you generate the query on the fly every time, the database will most likely not be able to help you at all with performance.
