So if a user without PR creates class with a DBList property and puts a bad query, this query will get executed when an user with PR will add an object of that class to his page (because the secure query manager checks PR on the context document)? Isn't it better to always use the secure query manager and to execute the query in the context of the class document? By putting the class document on the context before executing the script.