Patch that makes SQL injections impossible. CREATE VIRTUAL TABLE queries from the user interface are not allowed (no use for them since an underlying implementation does not exist for the virtual table;on the contrary a subsequent SELECT to the freshly created table would bring PiCO QL down). To continue there is also no good use for DROP table queries altogether;on the contrary after a DROP no queries would be possible to the underlying data structure.