got it....

just needed to add brackets to the @query variable when it's being executed to stop it being mistaken for a stored proc, so:

exec (@query)