Trouble using EXEC Command in SQL Server - sql-server

Question

Apparently there is a syntax error when i try to use the exec command to call parameter var's for table names.
Here's my code:
ALTER PROCEDURE [dbo].[createTable]
#tblName varchar(30),
#tblSTDColumns int = 0,
#dupExistTblName varchar(60) = ''
AS
BEGIN
SET NOCOUNT ON;
SET #dupExistTblName = #tblName + '_COPY'
IF EXISTS (SELECT 1 FROM INFORMATION_SCHEMA.TABLES
WHERE table_name LIKE #tblName)
(
EXEC('SELECT * INTO [' + #dupExistTblName + '] FROM [' + #tblName + '] WHERE 1=2')
)
EXEC('DROP TABLE ['+ #tblName + ']')
EXEC('SELECT * INTO [' + #tblName + '] FROM [' + #dupExistTblName] + ' WHERE 1=2')
END
The line EXEC('SELECT * INTO [' + #dupExistTblName + '] FROM [' + #tblName + '] WHERE 1=2') generates a syntax error

Answer 1

You were missing some things, and misplacing others.
CREATE PROCEDURE [dbo].[createTable]
#tblName varchar(30),
#tblSTDColumns int = 0,
#dupExistTblName varchar(60) = ''
AS
BEGIN
SET NOCOUNT ON;
SET #dupExistTblName = #tblName+'_COPY'
IF EXISTS (SELECT 1 FROM INFORMATION_SCHEMA.TABLES where table_name like #tblName)
BEGIN
EXEC('SELECT * INTO [' + #dupExistTblName + '] FROM [' + #tblName + '] WHERE 1=2')
END
ELSE
BEGIN
EXEC('DROP TABLE ['+ #tblName + ']')
EXEC('SELECT * INTO [' + #tblName + '] FROM [' + #dupExistTblName + '] WHERE 1=2')
END
END

Answer 2

A) MSDN states this on every relevant page:
Validate all user input. Do not concatenate user input before you
validate it. Never execute a command constructed from unvalidated user
input.
B) IF statements in TSQL only work on the next proceeding query/command line in SQL. Using BEGIN END is a good way of ensuring proper execution. Your style of course, but being explicit is preferred.
C) Declaring variables between CREATE/ALTER and AS BEGIN imply you want those variables to have user input. (#dupExistTblName) is immediately replaced?
Below is one method that includes a style of security with the added bonus of RAISERROR to prevent fatal errors and provide feedback.
ALTER PROCEDURE [dbo].[createTable]
#tblName varchar(30)
-- #tblSTDColumns int = 0
AS
BEGIN
SET NOCOUNT ON;
DECLARE #string NVARCHAR(255);
IF OBJECT_ID(#tblName) IS NOT NULL
BEGIN
DECLARE #dupExistTblName varchar(60);
SET #dupExistTblName = #tblName + '_COPY';
BEGIN
SET #string = N'SELECT * INTO ' + QUOTENAME(#dupExistTblName) + ' FROM ' + QUOTENAME(#tblName) + ' WHERE 1=2';
--SELECT #string
EXEC (#string);
END
END
ELSE
-- no need for a fatal error from trying to input a bad table name.
RAISERROR('Unknown Error. You Entered: %s. Check syntax.'
, 10
, 1
, #tblName)
END
EXEC dbo.createTable #tblName = 'MyNAMEST'
Unknown Error. You Entered: MyNAMEST. Check syntax.
To add further protections, MSDN promotes use of sp_executesql which allows for caching of SQL statement themselves. There many different ways to write, such as the following:
EXEC sp_executesql N'SELECT * INTO QUOTENAME(#TblcopyName)
FROM QUOTENAME(#tbleName) WHERE 1 = 2'
, N'#TblcopyName NVARCHAR(50), #tbleName NVARCHAR(50)'
, #TblcopyName = #dupExistTblName
, #tblName = #tblName

Answer 3

Here's what I ended up with! Thanks everyone!
ALTER PROCEDURE [dbo].[createTable]
-- Add the parameters for the stored procedure here
#tblName varchar(30),
#dupExistTblName varchar(60) = ''
AS
BEGIN
SET NOCOUNT ON;
SET #dupExistTblName = #tblName+'_COPY'
PRINT #tblName + '-tbl name ' + #dupExistTblName
IF EXISTS (SELECT 1 FROM INFORMATION_SCHEMA.TABLES where table_name like #tblName)
BEGIN
BEGIN TRY
EXEC('SELECT * INTO [' + #dupExistTblName + '] FROM [' + #tblName + '] WHERE 1=2')
END TRY
BEGIN CATCH
END CATCH
EXEC('DROP TABLE ['+ #tblName + ']')
PRINT 'TABLE DROPPED'
EXEC('SELECT * INTO [' + #tblName + '] FROM [' + #dupExistTblName + '] WHERE 1=2')
END
END