How can I securely allow user defined SQL querries?
===

I want to allow users to query a database with some fairly flexible criteria.  I could:

    String slqCmdTxt = "SELECT * FROM TheTable WHERE " + userExpression;

but I know this is wide open to SQL injection.  Using parameters is good, but I don't see a way to allow very flexible queries.  

How can I allow flexible database queries without opening myself up to SQL injection?
securely 
Tom