How to disable OUTFILE and INFILE?

Question

From what I understand, including OUTFILE and OUTFILE very dangerous. Everything that allows other people to write and read files from the system is dangerous for me, and since there is a public website on my server. I know that the best solution is to prevent SQL Injection with my code, but a person can sometimes make mistakes. Therefore, I want to limit the user that is used in my PHP to very limited access. If things go wrong, damage will be minimized.

How to disable OUTFILE and OUTFILE ?

Answer 1

User permissions for FILE apply to operations such as LOAD DATA / INFILE / INTO OUTFILE:

"The FILE privilege gives you the right to read and write files to the server using the LOAD DATA INFILE and SELECT ... INTO OUTFILE commands and the LOAD_FILE () function. A user who has the FILE privilege can read any file on the server host that either readable or readable on a MySQL server.

Using REVOKE to manage file privileges from mysql CLI:

 #change to mysql system db use mysql; #use the REVOKE (opposite of GRANT) to disable any FILE operations #in all dbs for the specific user/host. use % to block all hosts. REVOKE FILE on *.* FROM 'specificuser'@'specifichostname'; 

Alternatively, if you run into problems, you can selectively perform FILE operations on and within specific databases, in specific tables.

In addition, if you do not completely disable it, you can additionally configure the control to use dir like / tmp, limiting the crawl of data files of the sysvar_secure_file_priv system variable.

For more information, see the manual: FILE Privilege Syntax REVOKE System Variable: secure_file_priv

This question is a great example of how best to think about security from the “Deny Everything, specifically allow as necessary” thinking . Unlike the first granting of ALL user rights, and then their selective recall, which I see very often due to the lack of familiarity with the GRANT / REVOKE system in mysql.