Search code examples
sqlrubyruby-on-rails-3.1sequel

Ensure that a SQL query is READ-only


What would be the best way to ensure that a SQL query won't alter the data of a database?

In my scenario, you don't have access to the database layer and can only do this logic on the application layer.

Would you recommend using a gem, a ruby custom script?


Solution

  • You can manage the permissions of the users so that they have access for reading the database but they don't have access to alter the database (i.e. not able to insert, update and delete). If you are using mysql, for instance, you can easily do this in phpmyadmin or equivalent tool.

    Update based on your change. Even if you only have access through the application you are still connected to the database as a user who has or does not have privileges to update, delete, insert or select and as such the only way to ensure no such queries are executed is to alter that user's permissions.