How to "analyze" a SQL query? I'm not sure if I used the right term in my question.

I am creating a prototype, which allows users to type in a raw SQL query, which will query the backend DB. I want to also make sure that users only apply SQl to the tables that they are allowed to.

So when a user types in something like SELECT * FROM t1 WHERE id &gt; 10, I feel like I need to


Analyze the query to make sure that the tables are ok - in this case "t1"
They cannot access any other admin-type tables. For example, I don't want them to access "information_schema (i.e. for Postgres)"


What do you think the best strategy would be for this?

FYI, I'm NodeJS, so the primary programming language would be Javascript. 

Would I need to "parse" the query to make sure that the tables being accessed by the query are ok?
It's extremely hard to make this secure. Event if you are trying to be smart and check for every "possible" aspect. There is also dynamic SQL. And all kinds of ways to obfuscate code.

I wouldn't let the world run any query with more permissions than they should have.

If at all, I would create a user with restricted privileges, so that he can only do what he's allowed to in the first place. Also be aware that some database objects are visible to public by default, some tables in the system catalog like pg_class for instance ...