If your users enter nothing but the simplest selection operators, you will have a very difficult time for this. I suppose it would be too costly for your project to write a complete SQL parser, but that is essentially what you are talking about.
ORM, , , SQL- -, DataTable.Select, where SqlParameters.
, , , :
Linqer ( SQL LINQ), LINQ to DataSet
Linqer.
, , , . , , . , , , , . ( ) , , , .
@JoshC Sqlite, SQL Server 2012 LocalDB, , , , .net.