如何限制sqlite仅执行SELECT语句，而不执行INSERT，UPDATE

Question

I have a reports page where you can enter the query manually for a report. How can I block any INSERT, UPDATE or DELETE statements, and only run SELECT?

using (var connection = new SQLiteConnection(connectionString))
            {
                var da = new SQLiteDataAdapter
                {
                    SelectCommand = new SQLiteCommand(query, connection)
                };
                try
                {
                    da.Fill(table);
                }

I could check if the query string contains "INSERT", "UPDATE" or "DELETE", but I don't think it's a good practice.

Answer 1

Checking the query string is not good practice? Compared to what? Allowing a user to enter any SQL statement they want to in your report page? I can't think of a much worse practice than that. If you're going to allow that sort of thing, you absolutely need to somehow restrict the types of statements they enter, and maybe require a Where clause (to avoid millions of rows being returned) etc.

Answer 2

in fact did you check what happens when you try to fill the table with the data adapter having anything else than a select in the query variable? I doubt you get an empty table or dataset, I would expect an exception in which case you could rollback the transaction.

I would anyway try to create the connection as readonly as suggested above by Sorax and I would actually parse the query variable as well.

Answer 3

You could use an EXPLAIN statement to break the query down into VM instructions and examine the opcode column of the output. If the value "OpenWrite" occurs then the query is not read-only.

Answer 4

Since the SQlite database is just one file, my guess is that you can make the database readonly through the filesystem. This is of course not a fancy solution but is one that does not require any code (of course except when you're throwing exceptions when writing isn't possible).

Answer 5

A) Use a read-only connection - I think that would be almost the best solution

B) Use more than one TextBox as Input (but this would become more a solution like checking the String for Insert etc.)

For Example

Select | _ ___ | From | __ _ __ _ ___ | Where | __ _ __ _ _ |

Edit: to answer your comment just have a look at http://www.sqlite.org/c3ref/open.html especially the topic "SQLITE_OPEN_READONLY" - I haven't done anything with sqlite now, but I think that should do the trick...