3 ms·
On MySQL, you can run SLEEP() or BENCHMARK() as a read-only user to your heart's content. You cannot restrict access to these functions, and letting the wide in
by WesolyKubeczek 6y ago
On MySQL, you can run SLEEP() or BENCHMARK() as a read-only user to your heart's content. You cannot restrict access to these functions, and letting the wide internets play with them will bring your server to its knees by clogging up all connections and hogging up its CPUs.
- derision 6y agoSolution: Don't use MySQL
- eloff 6y agoAll rdbms have similar issues with built-in functions. Plus you can easily create pathological queries that do the same.
- WesolyKubeczek 6y agoPostgreSQL's SQL is Turing-complete. Imagine the possibilities!
- dllthomas 6y agoI wasn't contradicting the bits about DOS attacks, which remain very much a concern, even when no one is malicious.