This here will be interesting to you, I guess.

http://www.sommarskog.se/dynamic_sql.html#Common_cases

Parameterizing to get generic code is a good approach for everything that is handled at the client, it is the wrong approach when dealing with databases.