Whether sql is a single read query: one statement, starting with SELECT or WITH (after
comments and opening parentheses), whose CTE bodies and main statement are all reads, and
which does not write its result into a table (SELECT … INTO). Works from tokens, so it gives
the same answer for SQL the AST parser cannot read.
This is a statement-kind check, not a sandbox. A read query can still call functions with side
effects (set_config, pg_sleep); running caller-supplied SQL read-only and under a statement
timeout is what contains those.
Whether
sqlis a single read query: one statement, starting withSELECTorWITH(after comments and opening parentheses), whose CTE bodies and main statement are all reads, and which does not write its result into a table (SELECT … INTO). Works from tokens, so it gives the same answer for SQL the AST parser cannot read.This is a statement-kind check, not a sandbox. A read query can still call functions with side effects (
set_config,pg_sleep); running caller-supplied SQL read-only and under a statement timeout is what contains those.