Documentation
When the GUI runs out of room, drop to a CodeMirror SQL editor. Queries are validated read-only at the AST level — never a regex — so power users get full SQL without giving up safety.

Every query is parsed by a real SQL parser. Only SELECT and WITH … SELECT pass; multi-statements, INTO OUTFILE, LOAD_FILE, SLEEP, and (by default) information_schema access are rejected. Defense-in-depth adds a capability check, a query timeout, and bound parameters for every value.
A GUI chart can graduate to SQL, but arbitrary SQL can’t be reverse-engineered back to the GUI. If a SQL chart exceeds what the GUI can express, the GUI tab greys out and offers “Fork as new chart” rather than guessing — so you never get a broken round-trip.
Start with the free plugin from WordPress.org. Upgrade to Pro to unlock Ask, pre-computed charts and Editor roles.