Excellent. Got to think about the where clauses sometimes. They're not always obvious from the get go.

As for using dynamic SQL, that is a security risk. You should really uses a parametrized query. Variables on the end of a statement are particularly bad.