I have a pretty active discussion on SO right now, about giving an answer, that could potentially harm the questioner. The question is Do I need to encode/decode query parameters between an ajax request and the php receiving that request? and discussion is in comments to my answer.
In short, the OP asks for a way to implement a really dangerous thing. I've provided an answer to the question with a lot of warnings, while Stephen told me that this is a very bad idea, and it is better to use prepared statements, and so on. He is absolutely right; I'm among those who upvoted his answer, but the question remains.
So, I would like to hear community's opinion on that topic. Should we protect others from shooting in their legs, or let them have responsibility to do it, if they want?
Update: One of my university teachers created sql-ex.ru site (long ago). The idea of that site is to allow people training their SQL skills. I won't tell much about the site, you can register and check it out yourself (it is available in english), but the whole idea is just the same: execute SQL provided by the user. Of course it is fltered, checked that it is safe, placed in a sandbox, etc. But the concept is just the same. It's rather popular resource, it is on third place in most popular russian search engine and have large and growing community. I hope this update will stimulate further discussion.