Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Cannot disable LOCAL INFILE ( for security reasons ) in mysql Ver 14.14 Distrib 5.5.25a, for debian-linux-gnu (i686) using readline 6.2 on ubuntu 12.04; Here is my /etc/mysql/my.cnf

port            = 3306
socket          = /var/run/mysqld/mysqld.sock

socket          = /var/run/mysqld/mysqld.sock
nice            = 0

user            = mysql
pid-file        = /var/run/mysqld/
socket          = /var/run/mysqld/mysqld.sock
port            = 3306
basedir         = /usr
datadir         = /var/lib/mysql
tmpdir          = /tmp
lc-messages-dir = /usr/share/mysql

I do

sudo /etc/init.d/mysql restart

mysql -u root -p

mysql> SELECT load_file("/etc/passwd");

And it shows me my /etc/passwd content. So it didn't work.

share|improve this question

migrated from Aug 21 '12 at 8:06

This question came from our site for professional and enthusiast programmers.

before firing your select query, try the statement "show variables like "load_infile"" and check if your change has taken effect or not. – shubhansh Aug 20 '12 at 14:53
SHOW VARIABLES shows | local_infile | OFF – FoREacH Aug 20 '12 at 17:00
LOAD DATA LOCAL INFILE '/etc/passwd' INTO TABLE table1 -> ; ERROR 1148 (42000): The used command is not allowed with this MySQL version ===> ALL WORKS, but SELECT load_file("/etc/passwd"); loads file ! – FoREacH Aug 20 '12 at 17:19
This belongs on Ask Ubuntu. – Esoteric Screen Name Aug 20 '12 at 20:58
up vote 2 down vote accepted

From MySQL Docs for load_file reference, it can be seen that load_file is MySQL function that returns content of the file as string. It does nothing more than that. It has nothing to do with local_infile.

For security purpose, from same docs:

If the secure_file_priv system variable is set to a nonempty directory name, the file to be loaded must be located in that directory.

So if you set the system variable "secure_file_priv", then file has to be present in that particular directory. Moreover, user requires File level privileges to execute this statement. Simply do not give file level privileges to your users who are accessing database, if you want it to be secured.

Further local-infile is for LOAD DATA statements, which loads data into table, thereby affecting tables. It has nothing to do with load_file() function.

share|improve this answer
Thanks for the great answer :) – FoREacH Aug 22 '12 at 9:58

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.