Re: Semi-customized queries? Subset of SQL? Accessing the parser? Injection?

On Tue, Nov 4, 2008 at 2:12 PM, Webb Sprague <webb(dot)sprague(at)gmail(dot)com> wrote:

> Can't do that. (Or I wouldn't have asked the question.) Need a WWW
> interface, period.

A WWW interface doesn't preclude the suggestion of simply relying on
permissions to maintain safety and providing what amounts to a query
command line; I've got that exact thing in php for one of my DBs. The
user can't make db changes, and just from paranoia I check the query
for certain bad keywords (delete, insert, into, update, drop, create,
alter, etc) before passing it on. On return, some simple php functions
create a table with the appropriate column names and such.

It's surely the simplest solution, and it definitely will work.

--
- David T. Wilson
david(dot)t(dot)wilson(at)gmail(dot)com