security issues aside about running arbitrary strings from users, you could just do something like (you probably want some kind of injection-projection against ";commit" or something) just run it, check result/error, and rollback .. Assumes of course that the db supports transactions...