title: DataContext ExecuteQuery
body: <pre><code>string query = @"SELECT ColA, ColXML FROM TableT WHERE ColXML.exist('/SuperNode/Node/SubNode[.=({0})]') = 1";
  string param = "''value1'',''value2'',''value3''";
  string sQ = string.Format(query, param);
  
  A: dbContext.ExecuteQuery(sQ);
  
  B: dbContext.ExecuteQuery(query, param);
  </code></pre>
  
  <p>A executes and returns result but B doesn't.</p>
  
  <p>Any reason for this? Also, does the param gets validated for common <code>SQL</code> injection patterns?</p>
  
  <p>Thanks for any pointers!</p>