It is well-known that the SQL function
SLEEP() can be used to attack web applications, e.g. as described here. The sleep function cannot be disabled since it is compiled into the MySQL code and does not require any special privilege.
My question is: does MySQL include any functions except
SLEEP() which have all of the following properties?
The function is not commonly required by web applications. Say, 95% of CRUD apps don't need to use the function.
The function is not provided by an external plugin, but is included in the core MySQL codebase.
The function does not require any special privileges to be executed.
The function provides some non-zero benefit to attackers in a SQL injection.
My motivation for the question: I am interested in techniques to prevent SQL injections by limiting MySQL functionality. I am curious if
SLEEP()-injections are the only candidate for this technique or if there are other attacks that could be prevented.