title: SQL query to remove the preceeding and appended text
body: <p>I'm building a query to run against a database by appending user entered data with some additional information like this:</p>
  
  <pre><code>SELECT * FROM vBranch  WHERE (((BranchIsActive = 'Yes' AND BranchIsValid = 
  'Yes') AND BranchIsInternational = 'Yes' AND 1=2) AND 
  vBranch.BranchSecurityGroup=1).
  </code></pre>
  
  <p>This part: </p>
  
  <pre><code>SELECT * FROM vBranch WHERE ((
  </code></pre>
  
  <p>is appended by me,</p>
  
  <p>and this part: </p>
  
  <pre><code>(BranchIsActive = 'Yes' AND BranchIsValid = 'Yes') AND BranchIsInternational 
  = 'Yes'
  </code></pre>
  
  <p>is the user entered value </p>
  
  <p>and this part: </p>
  
  <pre><code>AND 1=2) AND vBranch.BranchSecurityGroup=1)
  </code></pre>
  
  <p>is also appended by me.</p>
  
  <p>What my doubt is whether the user can write any query which excludes the string which i appended before and after the user entered data and execute only the data which the user entered against the database? Is it possible? 
  One thing to note is that i've restricted few DML and DDL statements too except the "select" statement since i'm building a "select" statement to execute against the database.</p>