Safe SQL String Buildling in .NET

Public Enum SqlDataType
	 Text
	 Number
	 [Date]
	 CommaDelimitedNumber
	 CommaDelimitedText
	 [Boolean]
End Enum

Public Shared Function SqlStringFieldValue(ByVal fieldValue As Object, dataType As SqlDataType) As String

	Dim ret As Boolean
	Dim out As String = ""
	Dim sFieldValue As String = ""
	Dim sTmp As String = ""
	Dim iCnt As Integer = 0
	Dim tmpNumber As Double = 0
	Dim tmpDate As DateTime
	Dim aTmp() As Object

	sFieldValue = CType(fieldValue, String)

	If Not sFieldValue Is Nothing AndAlso sFieldValue.Trim().Length > 0 Then
		Select Case dataType
			Case SqlDataType.Text
				out = "'" & sFieldValue.Trim().Replace("'", "''") & "'"

			Case SqlDataType.Number
				out = CType(Utilities.FixNumber(sFieldValue), String)

			Case SqlDataType.Date
				Try
					tmpDate = DateTime.Parse(sFieldValue)

					out = "'" & tmpDate.toString("yyyy-MM-dd hh:mm:ss") & "'"

				Catch x As FormatException
					'do nothing
				End Try

			Case SqlDataType.CommaDelimitedNumber
				aTmp = sFieldValue.Split(CType(",", Char))
				For iCnt = 0 To aTmp.GetUpperBound(0)
					tmpNumber = Utilities.FixNumber(aTmp(iCnt))
					If tmpNumber > 0 Then
						If out.Length > 0 Then
							out = out & ","

						End If

						out = out & tmpNumber

					End If

				Next

			Case SqlDataType.CommaDelimitedText
				aTmp = sFieldValue.Split(CType(",", Char))
				For iCnt = 0 To aTmp.GetUpperBound(0)
					sTmp = aTmp(iCnt).ToString().Trim()
					If sTmp.Length > 0 Then
						If out.Length > 0 Then
							out = out & ","

						End If

						out = out & "'" & sTmp.Replace("'", "''") & "'"

					End If

				Next

			Case SqlDataType.Boolean
				Try
					ret = Boolean.Parse(sFieldValue)

					If ret Then
						out = "True"
					Else
						out = "False"
					End If
				Catch x As Exception
					'do nothing, suppress errors
					HttpContext.Current.Trace.Warn("Dls.Common.Utilities.SqlStringFieldValue(fieldValue, dataType), 2, Exception: " & x.Message)
				End Try

		End Select

	End If


	If out.Length = 0 Then
		out = "NULL"

	End If

	Return out

End Function

Dim sql As String = "SELECT * " & _
    "FROM Articles " & _
    "WHERE ArticleId = " & SqlStringFieldValue(Request.Params("id"), SqlDataType.Number)