Debugging mysql sproc, right syntax near 'NULL' - mysql

Question

I have written a sproc that will be triggered on inserting a new record to the table.
When called it returns an error 1064 and states:
'You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near 'NULL' at line 1'
The problem I'm having is I can't debug the inner query to find out where 'NULL' is. Or why its appearing.
Would appreciate if anyone can suggest how I could debug this, or, spot whats up with my code. N.B. I dont believe I can test the dynamic query outside of a sproc.
DROP PROCEDURE IF EXISTS SetUniqueCodeCustomLength;
DELIMITER $$
CREATE PROCEDURE SetUniqueCodeCustomLength (
IN TableName VARCHAR(255),
IN FieldName VARCHAR(255),
IN PKName VARCHAR(250),
IN PKID INT,
IN CodeLength INT)
BEGIN
SET #pass = '';
SET #loop = 0;
SET #matchCount = 1;
SET #sSQL = '';
WHILE #matchCount > 0 DO
SET #loop = 0;
WHILE #loop < CodeLength DO
-- random number from x-uy
SET #chr = SUBSTRING('abcdefghjkpqrstuvwxyz23456789', CAST( ROUND(RAND()*(29-1)+1) AS INT), 1);
SET #pass = #pass + #chr;
SET #loop = #loop + 1;
END WHILE;
-- Check for unique-ness.
SET #sSQL = CONCAT('SELECT COUNT(*) INTO #matchCount FROM ' + #TableName + ' WHERE ' + #FieldName + ' = ''' + #pass + '''');
PREPARE stmt FROM #sSQL;
EXECUTE stmt;
DEALLOCATE PREPARE stmt;
END WHILE;
SELECT #pass;
-- perform the update
SET #sSQL = CONCAT('UPDATE ' + #TableName + ' SET ' + #FieldName + ' = ''' + #pass + ''' WHERE ' + #PKName + ' = ' + #PKID);
PREPARE stmt FROM #sSQL;
EXECUTE stmt;
DEALLOCATE PREPARE stmt;
END$$
DELIMITER ;
Calling with:
CALL SetUniqueCodeCustomLength('Posts', 'PostCode', 'PostID', 7, 6);

Answer 1

Some observations:
Stored procedure's parameters (13.1.16 CREATE PROCEDURE and CREATE FUNCTION Syntax) are different from User-Defined Variables (9.4 User-Defined Variables), eg.: IN TableName != #TableName.
Check CONCAT() syntax.
Be careful with prepared statements (security) and possible SQL Injections.
mysql> DROP PROCEDURE IF EXISTS `SetUniqueCodeCustomLength`;
Query OK, 0 rows affected, 1 warning (0.01 sec)
mysql> DELIMITER $$
mysql> CREATE PROCEDURE `SetUniqueCodeCustomLength` (
-> IN `TableName` VARCHAR(255)
-> )
-> BEGIN
-> SET #`sSQL` := CONCAT('SELECT ', #`TableName`); -- NULL
-> SELECT #`sSQL`;
->
-> SET #`sSQL` := CONCAT('SELECT ', `TableName`); -- SELECT Posts
-> SELECT #`sSQL`;
-> END$$
Query OK, 0 rows affected (0.00 sec)
mysql> DELIMITER ;
mysql> CALL `SetUniqueCodeCustomLength`('Posts');
+---------+
| #`sSQL` |
+---------+
| NULL |
+---------+
1 row in set (0.00 sec)
+--------------+
| #`sSQL` |
+--------------+
| SELECT Posts |
+--------------+
1 row in set (0.00 sec)
Query OK, 0 rows affected (0.00 sec)