Re: Semi-customized queries? Subset of SQL? Accessing the parser? Injection?

On Tue, Nov 4, 2008 at 2:12 PM, Webb Sprague <webb.sprague@gmail.com> wrote:

> Can't do that.  (Or I wouldn't have asked the question.)  Need a WWW
> interface, period.

A WWW interface doesn't preclude the suggestion of simply relying on
permissions to maintain safety and providing what amounts to a query
command line; I've got that exact thing in php for one of my DBs. The
user can't make db changes, and just from paranoia I check the query
for certain bad keywords (delete, insert, into, update, drop, create,
alter, etc) before passing it on. On return, some simple php functions
create a table with the appropriate column names and such.

It's surely the simplest solution, and it definitely will work.

--
- David T. Wilson
david.t.wilson@gmail.com