Question

I have an interface that I want to allow an arbitrary SQL select statement (as an input string) to be input that will select data from a given table for use in an operation. I want to make sure that this statement does not make changes to the database.

string query = GetStringFromForm(...);

DatabaseStatement statement(query);

statement.execute();

while (statement.fetch(...))
    ...

One way to implement this would be to create a new database user with the appropriate permissions and then execute the statement under that user. This would be a hassle as it would require setting up this new user and creating a new database connection for it and so on.

Is there a way to isolate the permissions for a single statement MySQL 5.5? Or some other way to do this?

Answer 1

With MySQL 5.6 you can do:

START TRANSACTION READ ONLY;

https://dev.mysql.com/doc/refman/5.6/en/commit.html

I think it’s what you’re looking for, but you have to upgrade to 5.6 to use it.