SQL Server : stored procedure not returning the correct results -

i have created stored procedure deletes list of usernames database. output of script weird. treats input username input column. why doing ?

create procedure [dbo].[sp_deleteusersfromdb]( @username varchar(500)) begin    declare @sql varchar(600)     exec('update [dbo].user set deleted = 1 username in (' + @username + ')')     print n'deleted users db' end 

when run

msg 207, level 16, state 1, line 1
invalid column name 'user1'.
deleted users database

table schema :

create table [dbo].[user]( [id] [int] identity(1,1) not null, [version] [int] not null, [username] [varchar](32) not null, [deleted] [bit] null,      constraint [user_pk]     primary key clustered ([id] asc) ) on [primary] 

the @username parameter must contain quoted usernames, eg "'user1', 'user2'"