I’ve got a string containing an SQL statement. I want to find out whether the query will modify data or database structure, or if it will only read data. Is there some way to do this?
More info: In our application we need to let the users enter SQL-queries, mainly as part of the applications report system. These SQL queries should be allowed to read whatever they like from the databse, but they shouldn’t be allowed to modify anything. No updates, deletes insert, table drops, constraint removals etc.
As of now I only test whether the first word in the string is “select”, but this is too constricting and too insecure.
Create a new user for that part of the application that only has select privileges. Bear in mind that you’ll also need to create synonyms for all the tables/views that that “read-only” user will be able to view.
The “regular” part of your application will still be able to do other operations (insert, update, delete). Just the reporting will use the read-only user.
As Horacio suggests, it is also a good idea/practice to add “wrapper” views that only expose what you want to expose. Some sort of “public API”. This can give you flexibility if you need to change the underlying tables and don’t want to/can’t change the reports to the new definitions of said tables. This might, however, be seen as a lot of “extra work”.