
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.
Database Operation
|
247
Many public MySQL-based sites such as slashdot.org have migrated from MyISAM
to InnoDB.
Loading Datafiles
If you have FILE privileges, you can bulk load data from a flat file to a MySQL table.
This has obvious security implications.
The SQL LOAD DATA command reads a flat file on the database machine into a
MySQL table. This could be used to load /etc/passwd into a table, then read it with a
SQL SELECT statement. Since end users should not be stuffing files into tables, it’s
best to restrict this to administrative accounts. For example, if you need to load a flat
file into a particular table every day, create a MySQL account for that purpose and
grant it load privileges:
GRANT FILE ON database.table TO user@host identified by "password"
The SQL LOAD DATA LOCAL command allows the database server to read files
from the client. This permits an evil server to grab any file from the database client,
or an evil client to upload a file of its choice.
Recent versions of MySQL (3.23.49+ and 4.0.2+) are compiled to include an explicit
--enable-local-infile option for backward compatibility. To disable this ability
completely, they can be compiled without this option. Local loads can also be dis-
abled at runtime by starting mysqld with the
--local-infile=0 option.
Writing Data ...