Creating a safe HTML form query template

I would like to be able to enter at least part of a SELECT SQL statement in an HTML form and have it return the results. But for obvious reasons I would like to limit this query to SELECTs

I am thinking that I will prepend a "SELECT " to the form data and strip out all semi-colons

are commands that are available in a mysql client available in mysql_query()? (i.e. c -- clear, q -- quit, etc.)

Is there anything else that I should be aware of that would allow a user to execute anything but a SELECT query?

[This message has been edited by RyanP (edited September 28, 2000).]

I don't know how relevant this would be, but in the MySQL client commands can end with a semi-colon or g, so you might want to catch that too.

i have a feeling that mysql client commands are not available in mysql_query() , but i just wanted to make sure

Hello Ryan,

I am thinking about doing the same thing. I think your plan to prepend the "SELECT" to the form data is a good idea, but what happen if the user make a mistake in their select statement? How do you deal with that? What I meant is, how do you prevent the browser from display the stupid "Internal Server Error" message and display a nicer message that let the user know that their is something wrong with their statement.

--DVN