MYSQL like 动态拼接 mysql动态拼接sql语句

begin
/**procedure body**/
if(m_parameter='') then
set @sqlStr=concat('select id,title,description,msg,logo,notice,views,grade,commenttimes from kmb01',' order by ',m_sort,' ',m_sortType,' limit ',m_index,',',m_length); 
else
set @sqlStr=concat('select id,title,description,msg,logo,notice,views,grade,commenttimes from kmb01 where ',m_parameter,' order by ',m_sort,' ',m_sortType,' limit ',m_index,',',m_length); 
end if;
 PREPARE msql from @sqlStr;
 EXECUTE msql;
end