I just asked an SQL related question, and the first answer was: \"This is a situation where dynamic SQL is the way to go.\"
As I had never heard of
Rowland is correct, and as an addendum, unless you're properly using parameters (versus just concatonating parameter values inline from provided text, etc.) it can also be a security risk. It's also a bear to debug, etc.
Lastly, whenever you use dynamic SQL unwisely, things are unleashed and children are eaten.