I have a table in a database (Mysql) which contains a field which stores sql strings on it. I mean complete queries as text (always select statements). To modify one of that queries is a "pain in the ass" because is needed first to connect to a vpn, then access to the database and finally modify the field with some software like Mysql Workbench or any other.
I'm developing in a website a control panel only accesible by site admins. In that control panel I'm thinking in create a form to modify that sql field. It can do the admins life easier to manage it.
I'm usually very aware of being careful with sql injections in all my forms, GET and POST requests, etc. I know this could be dangerous even being a restricted panel only for admins.
First question is: If I finally decide to create it and an admin user falls under control of a hacker, how bad would it be for me? Is there a possibility to "control" the sql statements to be stored to allow only select statements?
I know that some basic techniques like replace some dangerous reserved words for nothing, like DROP for example, are useless... the hackers can use simple tricks like
DRDROPOP which after replacing gets
DROP anyway and that kind of dirty tricks... or maybe they can ofuscante the sqls using Unicode, etc...
Second question: Is there any good guide to try to control and filter as much as possible sql "tricks" or is useless because ALWAYS is there a method to penetrate launching other "non-select" statements?