Listing 1: Example of Using sp_executesql to Execute a Dynamic String
DECLARE @status nvarchar(20)
DECLARE @sql nvarchar(4000)
SET @status=N'''paid'''
   +N','+N'''denied'''  -- or pass this string in as a parameter
SET @sql=N'select top 10 * from claim
   where status in (' + @status +
   N')'
EXEC sp_executesql @sql