Sometimes you also need to change the query itself, i.e. the tables that are joined, or the sort order.

Indeed. And you either do that in Stored Procedures using parameters that you've passed in (without manipulating them as strings), or you construct your parameterized query on the webserver with the joins and sorts that you need, and then pass it to the database along with the parameters it needs to stick in.

Like I said. It's a solved problem, and has been so for a dozen years now.