MySQL security issue with LOAD DATA INFILE

[mgm_03]

I was told by an expert that there are serious security issues with using LOAD DATA INFILE. He runs a hosting company and has FILE privileges disabled.

Can anyone elaborate more on this?

[SeanW]

Have a look at

[dev.mysql.com...]

If the mysql server is not supposed to allow logins, then this command will let a user read files that they normally shouldn't.

Sean

[coopster]

It depends on who the web server is running as and how the MySQL database server is setup and who the database server is running as. LOAD DATA LOCAL has some potential security issues but you would have to ask your friend to explain himself beyond that.

Security Issues with LOAD DATA LOCAL [dev.mysql.com]