I cant beleive youre letting your users write their own update statements.. you might as well just save yourself the time and effort and buy them a query tool like Toad for oracle (if you have oracle) or other freeform thing that will let them run rampage with.
What I have to ask is; why bother writing a parser or looking for one. The database already has one built in..
One of my apps sort of has this functionality in that it allows a user to enter a freeform query (the user is supposed to be a developer) that will run on a schedule. I test that the query works by asking Oracle to EXPLAIN PLAN FOR (query). Oracle balks if the query has a synta error, and I can relay that message back to the user. If youre using some low end db like access.. well i dont know how to get access to parse the statement without running it, but someone else might
Really though... rethink giving users riot rights very carefully
|