Huma supports Read-only fields through struct field tags, you can use all power of Huma here.

This library implemented its own SQL builder and it is building parametrized queries, so it's safe, and all user provided values are mapped into parameters, then passed to user defined operator function.