Index: src/pragma.c
==================================================================
--- src/pragma.c
+++ src/pragma.c
@@ -641,10 +641,15 @@
       }
       if( !zMode ){
         /* If the "=MODE" part does not match any known journal mode,
         ** then do a query */
         eMode = PAGER_JOURNALMODE_QUERY;
+      }
+      if( eMode==PAGER_JOURNALMODE_OFF && (db->flags & SQLITE_Defensive)!=0 ){
+        /* Do not allow journal-mode "OFF" in defensive since the database
+        ** can become corrupted using ordinary SQL when the journal is off */
+        eMode = PAGER_JOURNALMODE_QUERY;
       }
     }
     if( eMode==PAGER_JOURNALMODE_QUERY && pId2->n==0 ){
       /* Convert "PRAGMA journal_mode" into "PRAGMA main.journal_mode" */
       iDb = 0;

Index: src/sqlite.h.in
==================================================================
--- src/sqlite.h.in
+++ src/sqlite.h.in
@@ -2196,10 +2196,11 @@
 ** flag is enabled, language features that allow ordinary SQL to 
 ** deliberately corrupt the database file are disabled.  The disabled
 ** features include but are not limited to the following:
 ** <ul>
 ** <li> The [PRAGMA writable_schema=ON] statement.
+** <li> The [PRAGMA journal_mode=OFF] statement.
 ** <li> Writes to the [sqlite_dbpage] virtual table.
 ** <li> Direct writes to [shadow tables].
 ** </ul>
 ** </dd>
 **

Index: test/jrnlmode.test
==================================================================
--- test/jrnlmode.test
+++ test/jrnlmode.test
@@ -63,11 +63,20 @@
     PRAGMA journal_mode;
     PRAGMA main.journal_mode;
     PRAGMA temp.journal_mode;
   } 
 } [list persist persist [temp_journal_mode persist]]
-do_test jrnlmode-1.4 {
+do_test jrnlmode-1.4a {
+  # When defensive is on, unable to set journal_mode to OFF
+  sqlite3_db_config db DEFENSIVE 1
+  execsql {
+    PRAGMA journal_mode = off;
+  } 
+} {persist}
+do_test jrnlmode-1.4b {
+  # When defensive is on, unable to set journal_mode to OFF
+  sqlite3_db_config db DEFENSIVE 0
   execsql {
     PRAGMA journal_mode = off;
   } 
 } {off}
 do_test jrnlmode-1.5 {