sql server procedure error

Question

CREATE PROCEDURE USP_SEARCH_HOTELS
(
@Text varchar(50),
@Type varchar(40)
)
AS
BEGIN

Declare @Query VARCHAR(60)


IF @Type = 'By Country'
    BEGIN
    SET @Query = 'Hotel.countryName like '+ @Text+'%'
    END
ELSE IF @Type = 'By State'
    BEGIN
    SET @Query = 'HOTEL.stateName like '+ @Text+'%'
    END
ELSE IF @Type='By Property Name'
    BEGIN
    SET @Query='hotel.propertyname like'+ @Text+'%'
    End 
ELSE IF @Type='By Rating'
     BEGIN
     SET @Query='hotel.starRating='+ Cast(@Text as INT)
     END
ELSE IF @Type='By City'
    BEGIN
    SET @Query='hotel.cityName like '+ @Text+'%'
    END

    begin
    select * from hotel,tbl_cust_info
     where
    hotel.agentID=Tbl_Cust_Info.Cust_ID
    and
    (@Query)
    end

END

WHAT IS THE ERROR IN THIS PROCEDURE PLEASE HELP.

Answer 1

Edit: I was a bit worried about the SQL injection possibilities in my first answer so have rewritten it.

CREATE PROCEDURE USP_SEARCH_HOTELS
(
@Text varchar(50),
@Type varchar(40)
)
AS
BEGIN

DECLARE @Query nvarchar(1000)

IF @Type = 'By Country'
    BEGIN
    SET @Query = 'Hotel.countryName like @Text + ''%'''
    END
ELSE IF @Type = 'By State'
    BEGIN
    SET @Query = 'HOTEL.stateName like @Text + ''%'''
    END
ELSE IF @Type='By Property Name'
    BEGIN
    SET @Query='hotel.propertyname like @Text + ''%'''
    End 
ELSE IF @Type='By Rating'
     BEGIN
     SET @Query='hotel.starRating='+ Cast(@Text as INT)
     END
ELSE IF @Type='By City'
    BEGIN
    SET @Query='hotel.cityName like @Text + ''%'''
    END


SET @Query = 'select * from hotel,tbl_cust_info
     where
    hotel.agentID=Tbl_Cust_Info.Cust_ID
    and ' + @Query

EXEC sp_executesql @Query, N'@Text varchar(50)', @Text=@Text

END

Answer 2

DECLARE @Final nvarchar(1000)  -- Separate partial and final
DECLARE @Partial nvarchar(100) -- let's you maintain and debug better

SET @Final = 'select * from hotel
join tbl_cust_info 
on hotel.agentID=Tbl_Cust_Info.Cust_ID
where' + @Partial

Assumiung that you are invioking this via .NET run a Regexp on the Text to eliminate all chars that are not letters or space. Like [!@#$%^&*()?;:'"\|].

Consider rewriting as 5 sprocs (HotelsByCountry, HotelsByState, HotelsByCity, HotelsByName, HotelsByRating). That will increase you perf and let you do orderby and paging (like Row_number() OVER(order by StartDate)). It will also make them totally safe.