How to guard PostgreSQL from overcharged and/or malicious (read-only) queries?

I'd like to guard postgres from overcharged and/or malicious queries.

The queries are strinctly read-only (from a SQL users perspective).
For doing this I'd like to code two functions (preferrably pl/pgsql):

1. Filter out all SQL commands which are *not* read-only (no
DROP/DELETE/UPDATE/TRUNCATE).
2. Get the estimated time (units) from PostgreSQL planner in a
reliable way (if possible standard/ANSI).

Can someone give me some hints?

Yours, S.