I think it depends on the web page technology you are using. If you are using asp net web forms then the post back will contain the state of each user selectable option and provided you escape any text options to avoid sql injection attacks then you can simply go through each (option) control with your server side page script and build the sql dynamically server side. You will need to do a postback but the dynamic sql coding will be will be server side and the data is server side. The only thing you will need to handle is "no results"
Hope this helps