Writing MySQL stored procedures with parameters (dynamic execution of SQL statements)

This stored procedure queries user information based on user input conditions and sorting methods.
Call method: Call getusersdynamic ('Age <= 30 ','');

/******** Dynamically query user information ********/
Create procedure getusersdynamic (wherecondition varchar (500), orderbyexpress varchar (100 ))
Begin
Declare stmt varchar (2000 );
If length (orderbyexpress)> 0 then
Begin
Set @ sqlstr = Concat ('select ID, name, password, age
From users where ', wherecondition, 'ORDER BY', orderbyexpress );
End;
Else
Begin
Set @ sqlstr = Concat ('select ID, name, password, age
From users where ', wherecondition );
End;
End if;
Prepare stmt from @ sqlstr;
Execute stmt;
End; Note: Prepare stmt from @ sqlstr; here @ sqlstr
It must be written in this way. It cannot be a variable of declare. If you can write other statements, leave a message. Thank you.