Do I need to SQL escape parameters I pass to the Tridion broker?
===

I'm passing an SQL "like" query to the Tridion broker database, via the Query API:

    var mkc = new CustomMetaKeyCriteria("Text");
    var mvc = new CustomMetaValueCriteria(mkc, "%" + query + "%", Criteria.Like);
    query.Criteria = mvc;
    var results = query.ExecuteQuery();

The `query` variable is something that has been directly passed in by the user.

Do I need to try and SQL escape that parameter, or will Tridion handle this via parameterisation (or otherwise)?