ruby on rails - Multiple Database Users per function -

we exploring how sql inject risks can limited allowing key functions perform duties within our rails application. security officier, not full time rails person.

the way see it, writing database should occur when account created (registration) or account modified (user profile update). simplification purposes, let's assume no other updates happen within application users.

if not block sql injection attack on read request, protected better 2 separate calls.

can rails support following configuration? -

• one database connection "read" requests
• one database connection (same exact database) "write" requests

if so, how in database file , code requests?

i thought might post out.

class user < activerecord::base   self.abstract_class = true    ...  end 

cur = create update read

r = read only

class usercur < user    establish_connection "user_cur_database_#{rails.env}" end  class userr < user    establish_connection "user_r_database_#{rails.env}" end 

database.yml

user_cur_database_production:   adapter: w.e.sql   host: yourhost   username: user_cur   password: ********   database: yourdb  user_r_database_production:   adapter: w.e.sql   host: yourhost   username: user_r   password: ********   database: yourdb 

where users have different access permissions

you same thing on rails app instead of in db, know isn't looking can provide more help.

is there easy way make rails activerecord model read-only?