All geek questions in one place

In mysql, is "explaining ..." always safe?

If I allow a group of users to send "explain $whatever"to mysql (via Perl DBI using DBD::mysql), is there anything that the user could insert in $, whatever the database changes, leaks non-trivial information, or even cause significant database load? If so, how?

I know that through "explain $whatever"you can find out which tables / columns exist (although you have to guess the names), and about as many records in the table or how many records have a certain value for the indexed field. I do not expect anyone to be able to get information about the contents of non-indexed fields.

DBD::mysqlshould not allow multiple statements, so I do not expect that it will be possible to execute any request (just explain one request). Even subqueries should not be executed, simply explained.

But I'm not a mysql expert, and of course there are mysql functions that I don’t even suspect about.

When trying to find a query plan, can the actual optimizer run an expression to come up with a value that will be compared with the indexed field?

explain select * from atable where class = somefunction(...)

where it is atable.classindexed and is not unique, and class='unused'will not search for records, but class='common'will find a million records. Can "explain" the assessment somefunction(...)? Is it possible to write somefunction(...)so that it changes the data?

+3
source share
3 answers

"" , , (, , ).

"" , ( 32- , 64- ) ( , ).

, - SQL . , , , .

EDIT:

, / , EXPLAIN .

,

SELECT * FROM (
  SELECT h1.*, h2.* FROM huge_table h1, huge_table h2) AS rediculous

tmpdir.

+6

"", , . ,

explain select * from user where name='tye' and secret like '%a%'

"", , "".

+3

, , , - SELECT, .

+1

Source: https://habr.com/ru/post/1784356/

More articles:


All Articles