问如何防止WiQL注入

EN

        string projectName = "user supplied input";
        string tenantId= "user supplied input";

        var wiql = new Wiql()
        {
            Query = $@"Select [Id] From WorkItems 
                        Where [System.TeamProject] = '{projectName}' 
                        And [Custom.TenantId] = '{tenantId}'
                        Order By [State] Asc, [Changed Date] Desc"
        };

        // create instance of work item tracking http client
        var adoUri = new Uri($"{VSTS_URL}");
        using (var trackingClient = new WorkItemTrackingHttpClient(adoUri, credentials))
        {
            // execute the query to get the list of work items in the results
            var result = await trackingClient.QueryByWiqlAsync(wiql);
        }