Adi, thank you for you answer.

When I have to use dynamic sql, security is no problem, because it's an "in the house" job, used for reporting.

But I was hoping for better solution, where the user could give an "array of numbers" for choosing the items used in the report.