Dynamic SQL use sp_executesql instead of EXECUTE Command

sp_executesql is more efficient, faster in execution and also supports parameter substitution

refer
http://www.codeproject.com/KB/database/Building_Dynamic_SQL.aspx