SqlMacro security problem / sql injection

[martin.p.wyser@…]

The SqlMacro plugin checks that the query (from the user) starts with \s*SELECT, but I can enter a select statement first, and then tack on other statements with a semicolon in postgres, like this:

select 1;
create table my_table (...);
insert into my_table (...) values (...);

The right solution to this is not to parse the statement, but use a connection with a read-only user, or to accept the insecurity and not to check the statement.