CODEWITHSUNDEEP
pythonsqldjangosecuritysql-injection
Wander Nauta
Wander Nauta

Reputation: 19675

How can I limit an SQL query to be nondestructive?

I'm planning on building a Django log-viewing app with powerful filters. I'd like to enable the user to finely filter the results with some custom (possibly DB-specific) SELECT queries.

However, I dislike giving the user write access to the database. Is there a way to make sure a query doesn't change anything in the database? Like a 'dry run' flag? Or is there a way to filter SELECT queries so that they can't be harmful in any way?

I thought about running the queries as a separate MySQL user but I'd rather avoid the hassle. I also thought about using Google App Engine's GQL 'language', but if there is a cleaner solution, I'd certainly like to hear it :)

Thanks.

Upvotes: 2

Views: 642

Answers (2)

Extrakun
Extrakun

Reputation: 19325

Create and use non-modifiable views.

Upvotes: 1

Ignacio Vazquez-Abrams
Ignacio Vazquez-Abrams

Reputation: 799082

Connect with a user that has only been granted SELECT permissions. Situations like this is why permissions exist in the first place.

Upvotes: 14

Related Questions