ruby on rails - User-generated SQL Query -

i'm developing data warehouse using ruby on rails , should allow user perform arbitrary select queries on application database.

i know shouldn't do, it's interface client needs (i can't think of possible queries user might want , translate them activerecord queries). there complex joins , sub-queries , on. i'd rather (integrate app) let them access db via pgadmin (i'm using postgresql).

my question is: safest way of doing this? should able escape insert, update, drop table, etc...

i'm thinking of getting query string , sanitizing these "dangerous" words , using activerecord::base.connection.execute(sanitized_sql_string). reasonable approach?

the safest way let postgres handle security you. create new user:

create user reader; -- rails app should logon user 

then, explicitly grant select permissions on objects want them able query:

grant insert on tablefoo reader; grant insert on tablebar reader; 

then, they'll able run arbitrary select queries these 2 tables, if try insert, they'll permission denied. can trap security exceptions , handle them in ui appropriately.