If I was doing something like this, then I would NOT provide the user with a text box to type in parameters to the selection. The user would not know the format needed, and a naughty user might try to cause trouble by deliberatly entering harmful text. So instead I would create a selection list that the user would pick an item for his search.
In Javascript the SQL string can be created with dynamic text, and using string concatenation. Something lise
[code]
var sName = "George"; // Where the name is actually fetched from a selection list.
var sqlstring = "SELECT * FROM DBNAME WHERE NAME='" + sName + "'";
[/code]
This would produce the string "SELECT * FROM DBNAME WHERE NAME='George'", which can then be used in the SQL request.
In the industry it is actually a big error to allow users to type in SQL stuff ad hoc. There could be destructive things like SQL insertion, or other huge security risks.
(My apologies, but I do not know if the code shown above will display properly)_