Is this safe from sql injection?
<p>I usually use sql parameters with queries, but in this case I need to dynamically create more than just the parameters.</p>

<p>Could someone use injection on any of the variables? Aside from a stored procedure is there a simple way to protect against injection via code?</p>

<pre><code>string whereClause = "WHERE " + filter.ToString() + " &gt; " + nextStartPoint;
string orderBy = "ORDER BY " + filter.ToString() + " DESC";   
</code></pre>

<p><strong>ex</strong></p>

<pre><code>string sql = "SELECT TOP(" + numItemsToGet + ") * " +
                                 "FROM Items " +
                                  whereClause + " " +
                                  orderBy;
</code></pre>

<p><em><strong></em> Update</strong> </p>

<p>filter.ToString() is the actual column name</p>

<p>I'm surprised the following worked (partial ex)... I also thought you have to reference a column name with sql parameters.</p>

<pre><code>cmd.Parameters.AddWithValue("Count", 10);

                    string sql = "SELECT TOP(@Count) * " +
</code></pre>
