Sanitizing string parameters in Cosmos DB to avoid SQL injection

Question

I have an application in which a Cosmos DB SQL Query is constructed dynamically, with some parts coming from untrusted user input. These parts are all string parameters in the WHERE clause and always enclosed in single quotes. For example:

SELECT * FROM c WHERE 
    c.prop1 = '{userInput1}' AND 
    STARTSWITH(c['{userInput2}'], '{userInput3}')

For various reasons it's not possible to use library features like SqlParameter to sanitize the user input, which obviously would be the ideal solution.

But given this constraint, would it be sufficient to escape backslashes and single quotes in the user input, i.e. replace \ by \\ and ' by \' , in order to avoid all SQL injection attacks?

---

(Updated to reflect the comment by @404)