Since the purpose of this is to allow users to query a table then the DB handler should use a DB user that has only query rights. No fancy parsing needed.