It would be handy to be able to optionally have any {macro} code in the SQL body executed. This would allow dynamic data such as the current user ID, date, time, etc to be entered via a macro and passed into the SQL query. The suggestion would be to have it off by default, and a 'macros=true' parameter available to turn the feature on. That should prevent any unexpected surprises...