Are you allowing your user to specify the columns of a SQL table which you'll store in your database ? Are you allowing your user to specify the table's name and column names ? Is there anything important in the database besides that table ? If so, you're opening yourself to numerous problems unless you give your user only very simple control over table and column names. Something like lower case letters only. If you. allow anything else you're going to have to develop some quite complicated code to make sure they're not going to corrupt the database. You will need similar very strict validation of table contents. Without it, it will be possible, by crafting malicious table contents, to corrupt your database. It is traditional at this point to quote the following: <https://bobby-tables.com> You mentioned a metadata table. If I understand you right, what you're talking about is simulating a SQL table: you won't create a genuine SQL table in your database which matches user input, you will instead simulate that table, probably using triplets (table, column number, value). This may be the way to go, though depending on how you validate inputs it may still be possible to corrupt your database.