No. No way to stipulate the database name in a variable without using dynamic SQL of some sort.

So far as SQL injection goes, your code is wide open for it the way @DBName is currently used. The best way around it is to check that the content of @DBName actually exists in sys.databases or throw a fatal error.

Items 2 and 4 may run but they don't actually work the way you would expect. Since you double single-quoted the @ck variable names, the variable names become quoted literals rather than variables.