How to escape user input in built liql query

It certainly depends on the type of input you're expecting.

For integers, I recommend something like this

<#assign id = http.request.parameters.name.get("id", "") />
<#attempt>
    <#assign id = id?number />
<#recover>
    <#assign id = 0 />
</#attempt>

And the reason I wrap that in an attempt/recover is because if id isn't a valid number, Freemarker will throw an exception. But we can catch that and set a default.

You can then check, if id == 0, then don't run the rest of your code because something is wrong.

For strings, if you know to expect a certain set of values, I'd verify it's from the expected set of values. If it's an arbitrary value, you can escape it with ?html which will convert most characters to it's HTML-entity equivalent, and should protect you from the most common problems.