Dangerous MySQL functions It is well-known that the SQL function SLEEP() can be used to attack web applications, e.g. as described here. The sleep function cannot be disabled since it is compiled into the MySQL code and does not require any special privilege.

My question is: does MySQL include any functions except SLEEP() which have all of the following properties?


The function is not commonly required by web applications. Say, 95% of CRUD apps don't need to use the function.
The function is not provided by an external plugin, but is included in the core MySQL codebase.
The function does not require any special privileges to be executed.
The function provides some non-zero benefit to attackers in a SQL injection.


My motivation for the question: I am interested in techniques to prevent SQL injections by limiting MySQL functionality. I am curious if SLEEP()-injections are the only candidate for this technique or if there are other attacks that could be prevented.
You are looking in a bad way. Those security limits can get back to bite you.

The right solution is to sanitize user input etc. to prevent injection to happen.

SQL Injection isn't an error on the database side instead it is on the application side.

If you try to protect only db somebody will attack the app server and once there he can do full dump.