On one end of the spectrum we get maximum flexibility by just exposing underlying data store via REST API (running queries passed via ... either static (column_name) or dynamic (expression). Alias can ...
Use parameterized queries instead of dynamic queries to prevent SQL injection, separating data from SQL commands. Implement content moderation processes to review and approve UGC before publishing ...