I agree that the database user privileges should be tuned to prevent him for running DML or DDL queries but I'm trying to do a similar thing from the client side. The JDBC side.
I downloaded Oracle driver found here.
While the driver and it's companion JARs are in the classpath, I ran the following piece test code:
Connection connection = DriverManager.getConnection(url, username, password);
connection.setAutoCommit(false);
// connection.setReadOnly(true); // Doesn't help
Statement statement = connection.createStatement();
statement.executeQuery("ALTER TABLE GELBANA_TEST.TABLE1 ADD HQ varchar2(40) DEFAULT 'NY'");
connection.rollBack();
But the column is added to the table !!
I can also drop the column. Shouldn't this be enough to prevent the user from running DML or DDL queries ? I need to stop him from making any changes to the database. He should be allowed to only select data. I checked the connection URL parameters for something that could reject such queries but I found nothing close.