The reason being that in a variable you don't need to worry about the ' escaping nonsense, however, since you are using a variable to build another SQL string and execute that, then you'll need to ...