... where true

...the next best approach is to ensure proper escaping of special string characters in input parameters.

Using an ORM does not automatically make you immune to SQL injection, however.

IQueryable<Users> GetCompromisedUsers(DataConnection db)
{
   return from u in db.GetTable<User>()
      where db.GetTable<CompromisedConnections>.Any(c => c.UserId == u.UserId)
      select u;
}

var ids = GetCompromisedUsers(db).Select(u => u.UserId).ToArray();

var query = from u in GetCompromisedUsers(db)
    from b in db.GetTable<Billing>().LeftJoin(b => b.UserId == u.UserId)
    select new { User = u, Billing = b };
// Simple shows how query can be tunelled across objects
var compromisedAndPaidNotEnough = from q in query
   where Sql.ToNullable(q.Billing.Amount) ?? 0 < 100
   select q.User;

// Deactivate users
compromisedAndPaidNotEnough
  .Set(u => u.Deatctivated, true)
  .Set(u => u.DeactivatedOn, u => Sql.CurrentTimesatmp)
  .Set(u => u.DeactivatedCount, u => u.DeactivatedCount + 1)
  .Update();

// Insert into another table 
compromisedAndPaidNotEnough.Insert(db.GetTable<Users>.TableName(“DeletedUsers”), u => u); 

// Delete them
compromisedAndPaidNotEnough.Delete();

db.Insert(myObject);

K>>IQueryable<SomeEntity> query = db.SomeEntities;

K>>if (someCondition1)
K>>    query = query.Where(...);

K>>if (someCondition2)
K>>    query = query.Where(...);
K>>

T>string sqlWhere=GetWhere(conditionID);
T>string sql="select blablabla from x3 where " + sqlWhere;
T>PopulateMyDbContext(sql);
T>

if (someCondition1)
    query = query.Where(...);

Using an ORM does not automatically make you immune to SQL injection, however. Many ORM frameworks allow you to construct SQL statements, or fragments of SQL statements, when more complex operations need to be performed on the database. For example, the following Ruby code is vulnerable to injection attacks:

def current_user(email)
  # This code would be vulnerable to a maliciously crafted email parameter.
  User.where("email = '" + email + "'")
end

As a general rule of thumb: if you find yourself writing SQL statements by concatenating strings, think very carefully about what you are doing.

The code samples below illustrate good and bad practices when trying to protect against SQL injection.
...
// LINQ will ensure safe passing of parameters.