Basically i have an option in my program where users can write their own sql, but i want to force it to allow only select queries

so i just make sure the first word is select.

is there anyway that someone can do an update, insert, or delete but having the first word as 'SELECT'

??