mysql 带参数存储过程

DELIMITER $
DROP PROCEDURE IF EXISTS sp_sUserLogin$
CREATE PROCEDURE `sp_sUserLogin`(userid varchar(72))
begin
     declare stmt varchar(2000);
     set @sqlstr=concat("SELECT UserID,UserFullNM from tbUser where CurrentUserFlg =1 and UserID='",userid,"'");
     prepare stmt from @sqlstr;
     execute stmt;
end$
DELIMITER ;

call sp_sUserLogin('10000');