关于动态sql

SELECT                                      zdop.dsnet_plcy_id                                    , zdop.strd_ym                                    , zdop.dsnet_plcy_rgst_ownr_cl_cd                                    , (SELECT zccd.comm_cd_val_nm                                                 FROM zngm_comm_cd_dtl zccd                                                 WHERE zccd.comm_cd_val = zdop.dsnet_plcy_rgst_ownr_cl_cd                                                AND zccd.comm_cd_id = 'ZTPM_C_ORGCD' ) dsnet_plcy_rgst_ownr_cl_nm                                    , zdop.dsnet_plcy_dtl_typ_cd                                    , (SELECT zccd.comm_cd_val_nm                                                             FROM zngm_comm_cd_dtl zccd                                                             WHERE zccd.comm_cd_val = zdop.dsnet_plcy_dtl_typ_cd                                                            AND zccd.comm_cd_id = 'ZTPM_C_CHNLC' ) dsnet_plcy_dtl_typ_nm                                    , zdop.brws_obj_cl_cd                                    , zdop.sms_snd_yn                                    , zdop.email_snd_yn                                    , zdop.note_snd_yn                                    , zdop.dsnet_plcy_prt_yn                                    , Decode(zdop.open_yn, 'Y' , zdop.dsnet_plcy_title_nm, '[임시저장중]' ||
                                      zdop.dsnet_plcy_title_nm) dsnet_plcy_title_nm                                    , zdop.open_yn                                    , zdop.atfil_rgst_id                                    , zdop.rgst_org_id                                    , (SELECT org_nm FROM zngm_org zo WHERE zo.org_id = zdop.rgst_org_id) rgst_org_nm                                    , zdop.rgstr_id                                    , SUBSTR(zdop.rgst_dtm, 0, 8) rgst_dt                                    , (SELECT zu.han_nm FROM zngm_user zu WHERE zu.user_id = zdop.rgstr_id) rgstr_nm                                    , zdop.audit_id                                    , TO_CHAR(zdop.audit_dtm, 'yyyymmdd') audit_dt                                    , (SELECT                                                 count(*)          cnt                                                FROM ztpm_dsnet_op_plcy_inq_answ zdopia                                                WHERE zdopia.dsnet_plcy_id = zdop.dsnet_plcy_id)  qa_cnt                        FROM ztpm_dsnet_op_plcy zdop                        %s                        WHERE zdop.strd_ym = :strd_year || :strd_month                       AND zdop.rgst_dtm BETWEEN nvl(:rgst_sta_dt, '20000101') || '000000' AND nvl(:rgst_end_dt, '99990101')        
                        %s                        
在js里写语句替换两个“％S”
var table = "TABLE tab";
var where = "AND" + "CODE_ID = cur_id";
其中CODE_ID代表字段，cur_id代表变量。
请指教这样写对不对？应该怎样写才对呢？