The advantage of using SQLite (as opposed to your primary DB) is that you don't have to care about sanitizing the queries or ensuring they don't see what they're not meant to because the user-specific DB only ever has data they are allowed to access, so even allowing them to run raw queries against (or download the whole database file) would be fine.