Pass two parameters, one the start year, one the end year, both of type datetime (or date, or datetime2). One parameter of a mess of strings is just going to cause headaches (what happens when someone passes "2000-yyyy" by accident?)