I thought about this too, but there are a few things to consider: 1) you need to separate any non-queryable data into it’s own table. So you’d need _public and

I thought about this too, but there are a few things to consider: 1) you need to separate any non-queryable data into it’s own table. So you’d need _public and _private tables for most data types 2) any type of filter query will need a JOIN, which leaves you vulnerable to malicious long running queries 3) some tables you don’t want people to run SELECT * on, otherwise they can get your entire site data 4) you need to be really careful with DELETE, UPDATE and INSERT queries to prevent malicious behavior Maybe one way would be to write a bunch of whitelisted regex patterns for allowed queries, but you’re definitely playing with fire allowing someone to send SQL queries to your DB.