That's a very bad idea. A user could craft any statement they like? They could wipe out the entire database.

Your question is a bit too general to give a meaningful answer. Give them a textarea, and pass in what they type as the value of the CommandText property.