I have a program that allows the user to execute SQL scripts. I have a user login to the program but a requirement has come in to prevent any execution even if its an admin user.
What I mean is the user cannot modify tables etc. Normally I would recommend all user connections be setup as read only but there is one element in the program that needs to be able to do an INSERT.
I want to detect the keywords that the user may execute eg/INSERT, UPDATE, ALTER and was hoping there was a defined list somewhere.
I think you are better off with a whitelist of things that you want to allow the user to do rather than trying to blacklist everything you do not want them to do.
Are they only allowed to run a SELECT?