I would attempt to solve this using static sql, rather than modifying the where clause every time.
To take a simple example, suppose I want to let the user do a search on a table called 'data_table' by supplying a list of values for column 'epic'. I would construct a table, 'search_values', with two columns - 'User_id' and 'value'.
When the user entered the search criteria I would insert into table search_values and then execute the following query:
select * from data_table
where epic in
(select value from search_values
where user_id = &user)
Of course it would also be necessary to add a cleanup step to delete the rows from search_values.
It seems to me that this approach is a little more complex than dynamic sql for simple searches. However it is also quite powerful. With the right design for the table 'search_values' it would be possible to support arbitrarily complex searches, including and, or, and not conditions on any number of columns.