To the best of my knowledge Crystal is ONLY a reporting\query tool and cannot update the data in the database.
However, if you are still nervous, or will be having regular users create reports, create a user on the DB side that has "read only" access (replace read only with the terminology used by your DB vendor) to the necessary tables. Then use ONLY this user account when creating reports.