I can think of two reasons:

1- The general belief that SPs are always faster. (not true)
2- Possibility of SQL injection from dynamic queries. (not always the case)

>Gary,
>
>I think part of it might be the "SP is always best" issue. If you're generating dynamic updates based on change tracking, you'd need screeds of code in a SP to manage that, plus presumably more in the middle tier to process the deltas and tell the SP what to do. In which case the obvious question is "why not build a dynamic parameterized SQL Update and bypass the SP."