Question

I was wondering if shared hosts generally grant access to this table to their users.

Would it be ok to rely on it to quickly get the current database structure from within a script?

My idea was to use this information to sanitize input lol. For example: UPDATE table SET field = ?

? can be a parameter (I’m using PDO), but what if I wanted to make field a variable to? Since PDO doesn’t support that, I could use data from the info schema to find out if that column exists…

Answer 1

Any MySQL user will have access to SELECT on information_schema, owing to the fact that the user must be able to read information_schema to be able to read from databases to which he’s been granted access.

You can test this out by creating a new user with only the SELECT privilege on a single table in a single database. The user will be able to read anything in information_schema related to the granted tables in that database, but not anything which hasn’t been granted.

/* Create a new user with only SELECT on one db: */
GRANT SELECT ON newdb.* TO newuser@localhost IDENTIFIED BY 'passwd';

/* Login with that user and list databases */
mysql> show databases;
+--------------------+
| Database           |
+--------------------+
| information_schema |
| newdb              |
+--------------------+

From the relevant documentation:

Each MySQL user has the right to access these tables, but can see only the rows in the tables that correspond to objects for which the user has the proper access privileges. In some cases (for example, the ROUTINE_DEFINITION column in the INFORMATION_SCHEMA.ROUTINES table), users who have insufficient privileges will see NULL.