I don't understand the part where you said that you have a very good handle on it. I really want to believe that it's as simple and solvable as you say it is. or do you mean that it's easily solvable - it's just that no one has done it yet? (In which case I think you are Simonw are saying the same thing?)

You mentioned the boundary between GET/POST args in a web app and a SQL query...but we have a system that is (by nature) mingling all of the parameters and execution together. It would be as if everyone's web server had a first line of their handler function that said something like "params = eval(user_based_params)", and you couldn't remove it...