I am creating a user control that passes some parameters to a results page via querystring. The results page consists of a QueryDataSource connected to a repeater.

I have added custom code to the layout of the querydatasource to build the where clause based on the parameters selected:

<script runat="server">
   protected override void OnLoad(EventArgs e) 
    { 
       string st = Request.QueryString["st"];
       base.OnLoad(e); 
       where = " View_mediaasset_Joined.DocumentName LIKE '%" + st + "%'";
       this.srcElem.WhereCondition = where;    
    }
</script>

This is a simplified version of what I am using. My concern is obviously SQL injection. I have seen several threads related to this but most were older and I am not sure what the best approach for this is with the current version of Kentico. Should I just do a replace looking for single quotes, does the latest version filter parameters passed this way, should I make them query parameters if so, what is the syntax for doing this dynamically.

Or is my approach flawed altogether.

Any assistance would be appreciated.