title: Embed DML/DDL as subquery?
body: <p>In an application that my team is developing, all users can define SQL-based filters, which are SQL-select-statements that return IDs.
  This statement, that is entered by the user, is then embedded in an <code>insert ... select ..</code> statement as an subselect clause.</p>
  
  <p>I do have a very bad feeling about this and I think this is a serious security issue, because users might find a way to execute dangerous abitrary SQL commands like <code>delete from...</code>.</p>
  
  <p>Restricting or removing this feature will certainly be against the customers will. Because of this, I would like to have an proof-of-concept that shows the problem.</p>
  
  <p>Hence my question:<br>
  Is it possible to execute some really dangerous statements that modify data or schema modifying using a subselect clause?</p>