SQL动态拼接字符串生成分页存储过程

今天做一个订单查询的时候，要求动态条件查询订单的明细，这个在后台写程序其实也很简单，但是今天脑洞大开，就尝试一下直接在写一条存储过程在后台动态拼接字符串然后查询，不知道这样写会不会有什么其他的问题呢？

具体代码如下：

本人还是个菜鸟，语文水平也很低，描述的比较含糊不清，望各位大神指点指点

USE [#####]
GO
/****** Object:  StoredProcedure [dbo].[MES_PDO_Page]    Script Date: 01/05/2016 18:08:31 ******/
SET ANSI_NULLS ON
GO
SET QUOTED_IDENTIFIER ON
GO
ALTER proc [dbo].[MES_PDO_Page]
@pageIndex INT,
@pageSize INT,
@Status INT,
@PDO VARCHAR(50),
@WorkCenter VARCHAR(50),
@pageCount  INT OUTPUT

AS
    BEGIN
        DECLARE @conditions NVARCHAR(500)
        DECLARE @sort NVARCHAR(50)
        --动态组合查询条件
        SET @conditions=' '
        SET @sort=' '
            IF (@Status>0)
            --因为是组合字符串，所以必须把数值类型转化为字符串，否则报错
                SET @conditions=@conditions+'AND (Status='+CAST(@Status AS NVARCHAR(10))+')'
                SET @sort='PARTITION BY Status '
            IF (@PDO IS NOT NULL)
            --'的转移字符是两个''
                SET @conditions=@conditions+'AND (PDO='''+@PDO+''')'
            IF (@WorkCenter IS NOT NULL)
            --SET @conditions+=@conditions+'AND (WorkCenter Like %'+@WorkCenter+'%)'
                SET @conditions+=@conditions+'AND (WorkCenter='''+@WorkCenter+''')'
                SET @sort='PARTITION BY WorkCenter '
            IF((@Status>0)AND(@WorkCenter IS NOT NULL))
            SET @sort='PARTITION BY WorkCenter,Status '
            --声明SQL语句字符串一定要长度要比字符串本身长度要长，不然会报错
            DECLARE @sqlPage NVARCHAR(2000)
            DECLARE @min INT, @max INT
            SET @min=@pageSize*(@pageIndex-1)+1
            SET @max=@pageIndex*@pageSize
            --同样因为是组合字符串，所以必须把分页数值类型转化为字符串，否则报错
            SET @sqlPage='SELECT * FROM
            (SELECT ROW_NUMBER() OVER ('+@sort+'ORDER BY ID DESC)AS RowNumber,* FROM MES_Base_PDO)AS PageData
            WHERE (RowNumber BETWEEN '+CAST(@min AS NVARCHAR(10))+' AND '+CAST(@max AS NVARCHAR(10))
            +') AND (IsDelete=0)'+@conditions
            EXEC (@sqlPage)
            
            DECLARE @sqlCount NVARCHAR(500)
            SET @sqlCount='SELECT @pageCount=COUNT(*) FROM MES_Base_PDO WHERE IsDelete=0'+@conditions
            declare @recordCount int
            exec sp_executesql @sqlCount, N'@pageCount int output', @pageCount OUTPUT
    END
    --exec sql和exec(sql)是有区别的.
    --exec sql是执行存储过程.
    --exec(sql)是执行sql字符串语句.
--
--EXEC (@sqlCount)