Securely composing dynamic queries with Ecto using values from database

I know, I know, I’ve worked with Elasticsearch before…
The problem is that this is not a greenfield project, there are very restrictive constraints in place. I can’t for example, impose an Elasticsearch cluster because it’s beyond the budget. Dedicated game servers are already too costly and most of the time the person behind it is not an expert to deal with a lot of ‘moving parts’.

Yes, it’s not ideal, but usually, this is a tradeoff the server administrator is willing to accept for better management because the game source code is not extendable or moddable enough.

It’s not about removing complexity per se, it’s about extending something that can’t be extended by the ordinary means. I’m gonna give you a hypothetical (but realistic) scenario:

Have you heard of a game called Legends of Aria? If not, the thing you should know is that this game allows creators to build their own rules on top of the base game. So I could, for example, host the game with my own set of rules (which I modified from the game tools). This way, any player that bought the game can enter the official server or my custom server.

Most of the time, those kinda games have tools that are closed source (except for some rare exceptions where the game is extendable to the core - looking at your Minecraft).
Because of that, we only have access to the database as an extension point. If I want to have a website that shows player data or an auction house or even sell cosmetic items, and the game tooling does not support that, the only way is to query and insert data directly to the database.
And then, there’s the fact that most of those games are built in completely different ways, so this has to be configurable by whoever is administrating the server. So far I’ve come to realize It’s a very unique problem.