How to pass a string variable in a Dynamic SQL query?