title: Converting custom search filters to dynamic SQL
body: <p>I'm writing a custom search page that will allow people search for artwork, but I want to allow users to enter custom commands/tags into the search box to let them have direct control on filtering their results without having to use anything but the search box. Let me give an example...</p>
  
  <p>I want the user to be able to type something like the following into a textbox:</p>
  
  <pre><code>Textbox Input: color=red|blue|green value&gt;=5.00+&lt;=10.00
  </code></pre>
  
  <p>Which would convert to the following SQL that I could peg onto the end of my SQL query:</p>
  
  <pre><code>AND (Artwork.Color = 'red' OR Artwork.Color = 'blue' OR Artwork.Color = 'green')
  AND (Artwork.Price &gt;= 50.00 AND Artwork.Price &lt;= 100.00)
  </code></pre>
  
  <p>What do you think about...</p>
  
  <p>1) Allowing people to type these custom commands into a textbox and converting these commands to SQL, is this normal practise? If not, how else would I allow advanced search options to be passed in, whilst keeping the page simple?</p>
  
  <p>2) The best way to convert these custom commands into SQL, how do I convert an unknown number of filters split by potentially multiple operators (+,|)?</p>
  
  <p>This is a web project built using ASP.NET (C#) and MSSQL. Thanks in advance! :)</p>