T-SQL (SS2K8) :: Multiple Parameters Using Full Search Index?

Using a full search index with the following query works with just one parameter.

declare @P0 varchar(50) = '"First*"'
SELECT *
FROM TableName
where contains ((Col1, Col2), @P0)

How do I make it work if I have two parameters, while also protecting the parameters from injection attacks?

declare @P0 varchar(50) = '"First*"'
declare @P1 varchar(50) = '"Second*"'
SELECT *
FROM TableName
where contains ((Col1, Col2), @P0 AND @P1)

If there weren't parameters, you put single quotes around the '@P0 AND @P1' to get this query to work.

In addition, while "where contains((Col1,Col2),@P0) and contains((Col1,Col2),@P1)" works, it appears to increase the execution time.