how is your user going to access this python code ?
does it have to be python, why?
I would be open to something else.
The user would be sent the python code to run, and then they can access it whenever they need to search something in the database.
so, if a user is sent the python code which is connecting to your database then whats stopping him from doing something they arent supposed to do?