<p>For a web application, I want to build a WHERE clause AND submit it to the server. There I will append it to a query. The clause will be something like</p>

<pre><code>LASTNAME LIKE 'Pep%' AND (DOB BETWEEN '19600101' AND '19601231 OR SALARY&lt;35000)
</code></pre>

<p>Can you propose a regular expression to validate the clause before submitting it to SQL Server?</p>

<p>(Yes, of course, I would like a regex for the ORDER clause)</p>

This is a monumentally bad idea. I would suggest you build a filter system instead where the user can select all kinds of options in a form, and then you build the correct sql server-side instead of opening yourself up to all kinds of injection attacks.
As an example of what might go wrong, consider this:
```
```
LASTNAME LIKE 'Pep%'--
DROP TABLE People
--
```
```
This will inject a DROP TABLE command into your SQL, which will be hard to detect. You can of course remove things like -- and /*, but I guarantee that someone can find a way in if you do this.