Stored Procedure Error

I am using SQL Server 2005 and wrote a stored procedure as shown below.

CREATE PROCEDURE [dbo].[GetUsers]
(
    @StartRowIndex INT,
    @MaximumRows INT,
    @SortExpression VARCHAR(50)
)
AS
BEGIN

    DECLARE @SQL VARCHAR(1000);

    DECLARE @Start VARCHAR(10);
    SET @Start = CONVERT(VARCHAR(10), @StartRowIndex + 1);

    DECLARE @End VARCHAR(10);
    SET @End = CONVERT(VARCHAR(10), @StartRowIndex + @MaximumRows);

    SET @SQL = '
        WITH Data AS(
            SELECT UserID, Username, FirstName, LastName,
            ROW_NUMBER() OVER(ORDER BY ' + @SortExpression + ') AS RowNumber FROM Users)

        SELECT UserID, Username, FirstName, LastName
        FROM Data
        WHERE RowNumber BETWEEN ' + @Start + ' AND ' + @End

    EXEC(@SQL);

END

In VS 2005, I am using a DataSet. Then I created an ObjectDataSource which binds the GridView control. However, I am getting the following error:  Incorrect syntax near ')'

After playing around with it, the error is from the line:
ROW_NUMBER() OVER(ORDER BY ' + @SortExpression + ') AS RowNumber FROM Users)

If I change the line to ROW_NUMBER() OVER(ORDER BY UserID') AS RowNumber FROM Users) it works fine, except for sorting.

I dont understand what I might be doing wrong.