|
|
Posted by Hilarion on 10/20/05 17:29
>> I'd like to give user possibility to add his custom queries to my page, but
>> I want him to be able to add only SELECT queries. I looked everywhere for a
>> function testing if query is only SELECT nothing else but couldn't find it
>> :-( Maybe you can give me sime directions?
>>
>> best regards
>> Mateusz [PEYN] Adamus
>
> Set up the form to collect column names (C), table names (T), the where
> clause (W) and, optionally, an order by or limit (O). Then create the
> 'SELECT (C) FROM (T) WHERE (W) (O)' and save that.
And what if the user types something like that as ORDER BY clause:
col1, col2; DELETE FROM some_important_table
Hilarion
Navigation:
[Reply to this message]
|