title: Should I allow a SQL WHERE clause as a REST API parameter, available on the internet?
body: <p>The project I'm working on has a REST API written in JRuby/Java, with an endpoint that hits a MySQL database to retrieve a number of records.</p>
  
  <p>We need to allow the client to filter those records using one or more columns, including boolean checks and range values.</p>
  
  <p>The easiest way we can do this is to add a string parameter to the API, then add it into the SQL statement. </p>
  
  <p>Collectively, the development team agree that this is a bad idea but the alternative is to provide an almost identical syntax for filtering, which is translated into SQL. The allure of the SQL injection parameter is strong.</p>
  
  <p><strong>So my question is, are there any circumstances under which this is a safe thing to do?</strong></p>
  
  <p>In particular, might we consider using the WHERE clause safely if it's been fully parsed beforehand, and identified as such. Or at the very least, checking for certain trigger words such as DROP, SELECT etc.</p>
  
  <p>Also if anyone knows of a good library that could act as a go-between (translating or parsing an external expression into a WHERE clause) that would be great.</p>