Question

For example I’ve often wanted to search stackoverflow with

SELECT whatever FROM questions WHERE
   views * N + votes * M > answers AND NOT(answered) ORDER BY views;

or something like that.

Is there any reasonable way to allow users to use SQL as a search/filter language?

I see a few problems with it:

• Accessing/changing stuff (a carefully setup user account should fix that)
• SQL injection (given the previous the worst they should be able to do is get back junk and crash there session).
• DOS attacks with pathological queries
• What indexes do you give them?

Edit: I’d like to allow joins and what not as well.

Answer 1

Accessing/changing stuff
No problem, just run the query with a crippled user, with permissions only to select

SQL injection
Just sanitize the query

DOS attacks
Time-out the query and throttle the access by IP. I guess you can also throttle the CPU usage in some servers