Hello,
You need to user exec SP_EXECUTESQL @sql. Since you are tring to execute dynamic query. sp_executesql is inbuilt stored procedure provided my microsoft which accepts a query in string format and executes the same against the databse.
There are two different way of executing the dynamic query.
1) without using inbuild Store procedure
exec (@sql)
2) Using stored procedure
exec SP_EXECUTESQL @sql