If you want to find out more about the technique, its called 'Dynamic SQL' (useful to search for it).
Also it can be problematic with users and their permissions, or so I've heard: as in you can grant a DB user permission to run a certain stored proc, but if it contains UPDATE/DELETE or the like inside dynamic SQL they may not be able to run the procedure.