No. You might be confusing SQL injection with data injection; read-only tables do not prevent SQL injection and at best do only a little to limit its impact.
SQL injection simply means the ability to inject SQL code. While read-only tables may limit the ability to inject data into the table, they don't impact the ability to:
- Read from other databases or tables if not disallowed
- Read from system tables or run other system queries which are hard to disallow
- Write excessively complex queries that will perform a DoS
- Exfiltrate data using DNS
- Access local files (e.g., utl_file in Oracle)
- Access the DB server's network (e.g., utl_http in Oracle)
- Execute arbitrary code on the server via DB function buffer overflows
- See Advanced SQL Injection in Oracle databases for a good walk through all the sorts of things you need to worry about (and realize other databases have their equivalents)
basically just want to tack what they enter onto the
then you're expressly permitting the attacker to try any of these.
Now, you can certainly do things to limit this. You can disallow quotes and SQL statement separator characters. You can disallow any input that's not
[A-Za-z0-9"=] (or effectively equivalent for your database). But if you start going down this path, you're better off writing your application correctly: Expose a richer query interface where you offer the keys to be checked and then you perform proper quoting on whatever values the user enters.