I really really like this creation of yours, and I've already learned a couple things from it.<p>However, you really really need to be careful about SQL injection. I can see that you tried to lock it down as much as possible, as far as I can tell the account the queries are running under only has SELECT permission (no update/delete/etc). However I was still able to get some data you probably don't want me to have...<p>This query returns a list of all tables in your database:<p>SELECT c.relname||'' FROM pg_catalog.pg_class c LEFT JOIN pg_catalog.pg_namespace n ON n.oid = c.relnamespace<p>And this query returns a list of users and their privileges:<p>SELECT usename||'', usecreatedb||'', usesuper||'', usecatupd||'' FROM pg_user<p>I guess your name is Andy based on your HN username, but who is Rusty? :) And that's just what I've been able to get in 5 minutes of trying, let alone a determined attacker.