Say you're building a tool that lets people run ad-hoc SQL against a database, and you want a read-only by default mode — a safety net so a fat-fingered UPDATE doesn't nuke a table.

The tempting first instinct is to look at the SQL:

FORBIDDEN = ("insert", "update", "delete", "drop", "truncate", "alter", "create")

def is_read_only(sql: str) -> bool:

lowered = sql.strip().lower()