Allow only “Select” statement for queries executed through PHP

Question

I have made a form that accepts query and executes it through php. I would like to apply a check on the input that only select statement is allowed for queries. How can i achieve that ?

Answer 1

Best way is if you have access to your database server and can create a new user, create a user with only a SELECT privilege, then assign that user to your php web application.

http://dev.mysql.com/doc/refman/5.1/en/grant.html#grant-privileges

Regex is fine, but it's a bit of a risky method to filter it out that way, you'll never know how creative your user can be :)

Answer 2

为了安全起见，您可以创建一个MySQL用户并仅为该用户授予SELECT权限 。