Like Mike already said, you're trying to reinvent the wheel!

If I were you, I wouldn't waste my time with such a thing.

The other important consideration is also already mentioned: SQL Injection

Read this and decide if that's still the way for you to go. Maybe you decide to go down stored procedures road to have better control.