Passing parameters in MySql procedure with prepare execute
Modify your SP for to look at the SQL text built:
fiddle
It is clear that you forget to wrap string literal value with single quotes. You must use
SET @quer = concat(
'SELECT ROUND(avg(prices.price),2)
 FROM ( SELECT current_Price as price 
        FROM UNION_SALES 
        WHERE location = ''', loc,''' 
          and current_Price &gt;5000
        ORDER BY current_Price ASC LIMIT ?) as prices;');

location can be used for SQL injection. You could fix it either by using a bound parameter (preferred), or by using QUOTE(location).