Have you considered setting up a stored procedure and calling it from script? You could return the recordset and they would never access your environment directly.

'******************************************************************************

'* Make connection...