SQL injections in Sharepoint Enterprise SQL search syntax

I am designing a web part where users can enter a search phrase the MOSS Search index is sought for that. I use FullTextSqlQuery class for searching.

When I create my select statement, I apparently have to use concatenation to include the user's input in it. The final statment should be something like this:

 SELECT ti开发者_JAVA百科tle, author from portal..scope() 
 WHERE ("SCOPE" = 'TheDocuments') 
 AND CONTAINS(MYPROPERTY, 'TheValueThatuserSpecified')

So, the question is, how do I avoid SQL(?) injections from user input? Is there some specific utility function for that? In php/mysql projects I'd use mysql_real_escape_string. Anything similar in SharePoint namespaces?

---

I haven't found any function to encode user input so I created my own method:

protected override string EncodeUrlParameter(string paramValue)
{
   StringBuilder sb = new StringBuilder();
   for (int i = 0; i < paramValue.Length; i++)
   {
       char c = paramValue[i];
       if (c == '*' || c == '%' || c == '[' || c == ']' || c == '_')
           sb.Append("[").Append(c).Append("]");
       else if (c == '\'')
           sb.Append("''");
       else
           sb.Append(c);
   }
   return sb.ToString();
}

This is mainly used for parameters filtered using the LIKE keyword (the documentation page has a note about this). The biggest thing I stumbled upon was when people tried to include apostrophes in their queries.

---

The FullTextSQLQuery class takes a "full text sql" query which is not true sql. The "full text sql" is parsed and converted to regular sql to query against table in the sql server database and to query against an external index file. There is no way to do sql injection via "full text sql", it will not pass validation. The "column names" you use in the "full text sql" must be valid "managed properties" that are set up in Search Administration, they do not point to actual column names on a table.

http://www.sharepointdev.net/sharepoint--search/is-fulltextsqlquery-protected-against-sql-injection-35184.shtml