Erik Darling theorizes about strings:
If you write the good kind of dynamic SQL, that is:
1. Parameterized
2. Executed with sp_executesql
You’ll probably have run into some silly-ish errors in the practice. Namely, that sp_executesql expects your SQL string and your Parameter string to be NVARCHAR(…).
Read on for some thoughts on data types, max-ness, and the like.