Re: Semi-customized queries? Subset of SQL? Accessing the parser? Injection?

On Nov 4, 2008, at 11:46 AM, Webb Sprague wrote:

>> Or do it with simple combo boxes if you
>> want to limit the users to crippled queries.)
>
> I want to limit my users to *half* crippled queries -- arbitrary
> column lists, where clauses, group by lists, and sort by lists. I
> want to make sure that they aren't doing any data modifications nested
> inside a where clause or a column definition as a subquery.
>
>> I don't see anything that suggests hacking the SQL parser
>> is going to be a useful thing to do.
>
> I would think that I could *use* (definitely not hack -- good god!)
> the parser to ask how deep the nested subqueries are, etc.

Have you looked at the output from "explain"? That'll give you
cost estimates, and fairly detailed data on how the query will
be executed, including nested queries, index usage and so on.

Cheers,
Steve