Validating an SQL query programmatically, with gotcha