Indeed. And you either do that in Stored Procedures using parameters that you've passed in (without manipulating them as strings), or you construct your parameterized query on the webserver with the joins and sorts that you need, and then pass it to the database along with the parameters it needs to stick in.

Like I said. It's a solved problem, and has been so for a dozen years now.