Question

I have a reports page where you can enter the query manually for a report. How can I block any INSERT, UPDATE or DELETE statements, and only run SELECT?

using (var connection = new SQLiteConnection(connectionString))
            {
                var da = new SQLiteDataAdapter
                {
                    SelectCommand = new SQLiteCommand(query, connection)
                };
                try
                {
                    da.Fill(table);
                }

I could check if the query string contains “INSERT”, “UPDATE” or “DELETE”, but I don’t think it’s a good practice.

Answer 1

You could use an EXPLAIN statement to break the query down into VM instructions and examine the opcode column of the output. If the value "OpenWrite" occurs then the query is not read-only.