pub fn check_read_only_sql(sql: &str) -> Result<()>Expand description
Reject anything that is not a single read statement.
A stored SqlSource.query is re-run on every refresh with the analyst’s
credentials, so it must not be able to write. After skipping leading
whitespace and -- / /* */ comments, the text must start with the
keyword SELECT or WITH, and a ; may only be followed by whitespace.
This is a cheap first line of defence (deliberately conservative: a ;
inside a string literal is rejected too). Each backend additionally runs
the query read-only (see Backend::query), which is what catches a
data-modifying CTE such as WITH x AS (DELETE ...) SELECT ....