MYSQL disable SELECT BENCHMARK

Question

Hi,

how would I disable the mysql benchmark function, thus not being subject to blind sql injection attacks such as "select if( user() like 'root@%', benchmark(100000,sha1('test')), 'false' );"

select * from func does not show up a function benchmark.

Kind Regards Charles

Answer 1

The best practice advise is to escape data before passing to the query or create prepared statements. Unfortunately not only benchmark function is that dangerous, so you would need to disable others ...