I agree, that this approach is in a thin ice.

It is doable in more traditional ways, but this was partly a test and also I think that this gives greatest freedom, couse you can use db directly.

I have 'layout-maker' in which user manipulates form-objects, but but this is just for populating options to select, cause in essence it is just name and value.

When I iterated in my mind, it always simplified to result of sql-query.

I know very well dangers of letting ppl to make queries on their own.
This will be, in the end admin-tool, in their intranet and even there is a way to manipulate those values and queries it needs a bit of knowledge
to make working sql-query (=select, insert, update or delete), when you don't know db-schema etc.

I don't think that anyone else than I'll touch to those sql-queries.
Only one, that I could imagine is worker who want to sabotage system and firm before leaving.