I appreciate that you're aware of the implications here. If you really wanted to be safe, then ... well, I don't think there is any way to be safe, really, when a method takes as input some string to run against the database. It's like the paradox of the HTML cleaner -- a terrible millstone around our neck that will drag us into the sea for eternity.

That is a philosophical point, though, and has no bearing on your code, which is fine. Long code reviews make me ramblesome. (That's not a word, but it really should be.)