fix: 数据变更工单拦截只读SQL — 前端提交/检测+后端创建三层拦截SELECT/SHOW/DESC/EXPLAIN

backend/internal/handler/ticket.go

@@ -219,6 +219,16 @@ func CreateTicket(c *gin.Context) {
 		return
 	}
 
+	// Reject read-only SQL statements (SELECT/SHOW/DESC/EXPLAIN)
+	upperSQL := strings.ToUpper(strings.TrimSpace(input.SQLContent))
+	readOnlyPrefixes := []string{"SELECT", "SHOW", "DESC", "DESCRIBE", "EXPLAIN"}
+	for _, prefix := range readOnlyPrefixes {
+		if strings.HasPrefix(upperSQL, prefix) {
+			c.JSON(http.StatusBadRequest, gin.H{"detail": "数据变更工单不支持 SELECT/SHOW/DESC 等只读语句，请使用查询数据功能"})
+			return
+		}
+	}
+
 	// Auto-fill workflow_id from instance if not provided
 	if input.WorkflowID == nil || *input.WorkflowID == 0 {
 		var inst model.Instance