I have a web api that connects to my SQL Server using a read-only connection and want to allow tech savvy users of my api to enter an SQL where clause on the querystring. I basically just want to tack what they enter onto the select statement. 

Does a least-privilege (select ability on one table only), read-only connection to the database prevent all injection attacks?

No.  You might be confusing SQL injection with data injection; read-only tables do not prevent SQL injection and at best do only a little to limit its impact.

SQL injection simply means the ability to inject SQL code.  While read-only tables may limit the ability to inject data into the table, they don't impact the ability to:


Read from other databases or tables if not disallowed
Read from system tables or run other system queries which are hard to disallow
Write excessively complex queries that will perform a DoS
Exfiltrate data using DNS
Access local files (e.g., utl_file in Oracle)
Access the DB server's network (e.g., utl_http in Oracle)
Execute arbitrary code on the server via DB function buffer overflows
See Advanced SQL Injection in Oracle databases for a good walk through all the sorts of things you need to worry about (and realize other databases have their equivalents)


If you


  basically just want to tack what they enter onto the select statement.


then you're expressly permitting the attacker to try any of these.

Now, you can certainly do things to limit this.  You can disallow quotes and SQL statement separator characters.  You can disallow any input that's not [A-Za-z0-9"=] (or effectively equivalent for your database).  But if you start going down this path, you're better off writing your application correctly: Expose a richer query interface where you offer the keys to be checked and then you perform proper quoting on whatever values the user enters.
