title: String Check on malicious SQL
body: <p>Im writing a simple utility that will allow our users to run simple select SQL statements on the DB to retrieve data they require. Just a textbox and a button and when they click the button it will spit out the query results in a list.</p>
  
  <p>The problem I have is I only want them to be able to run SELECT statements. I dont want any edit statements to be executed i.e. update, insert, delete, drop etc.</p>
  
  <p>Is there a simple way to parse a sql string to make sure its only a read only select statement entered?</p>