This is very nice,

but there's a better solution for the same issue.

http://www.madeira.co.il/fully-dynamic-search-conditions-vs-sql-injection