SQL SP exception: "Incorrect syntax near '-'"

[cdietschrun]

I am getting an exception thrown from my web app's call to a SQL SP. The expecption says "incorrect syntax near '-'". The dash I have narrowed down to an argument passed to the stored procedure contains dashes, such as 992-123-123. The SP works fine if the argument passed is 992123123. What is the best way of fixing this? In all likelyhood it is more important to keep the dashes in the entries in the columns. I think it is just my SP syntax, so here it is: @PACKAGE is the value that is giving issues, which is 999-999-999 style. CODE

CREATE PROCEDURE dbo.sp_UpdateItemColumn
(
@PACKAGE nvarchar(255),
@COLUMN nvarchar(30),
@VALUE nvarchar(100),
@LASTCHANGEBY nvarchar(100)
)
AS

declare @sql nvarchar(1024)
set @sql=''

set @sql=@sql+'update tbl_swbom_checklist_items set '+@COLUMN+'='''+@VALUE+''' where package='''+@PACKAGE+''' '

--print @sql

exec sp_executesql @sql
GO

[Thats Aragon]

hi there, please try to do below query. It is working perfect with the '-' value.

declare @sql nvarchar(1024)
set @sql=''
set @sql=@sql+'update tbl_swbom_checklist_items set ' + @COLUMN + '=' + '''' +@VALUE + ''' where @PACKAGE='''+ @PACKAGE +''''
exec (@sql)

Regards :)