ASCII()

This function returns the numeric value of the leftmost character of the string
str. Returns 0 if str is the empty string. Returns NULL if str is NULL
Syntax : ASCII(str)
Example : SELECT ASCII('2');
Output : 50
Example : SELECT ASCII(2);
Output : 50
Example : SELECT ASCII(‘An’);
Output : 65

BIN()

Returns a string representation of the binary value of N, where N is a longlong

(BIGINT) number. Returns NULL if N is NULL.
Syntax : BIN(N)
Example : SELECT BIN(12);
Output : 1100

BIT_LENGTH()

Returns the length of the string str in bits.

Syntax : BIT_LENGTH(str)
Example : SELECT BIT_LENGTH('text');
Output : 32

CHAR()

CHAR() interprets each argument N as an integer and returns a string

consisting of the characters given by the code values of those integers. NULL
values are skipped.
Syntax : CHAR(N,... [USING charset_name])
Example : SELECT CHAR(77,121,83,81,'76');
Output : MySQL
Example : SELECT CHAR(77,77.3,'77.3');
Output : MMM

CHAR_LENGTH()
Returns the length of the string str, measured in characters. A multi-byte
character counts as a single character. This means that for a string containing
five 2-byte characters, LENGTH() returns 10, whereas CHAR_LENGTH()
returns 5.
Syntax : CHAR_LENGTH(str)
Example : SELECT CHAR_LENGTH('test string');
Output : 11

CONCAT()

Returns the string that results from concatenating one or more arguments. If
all arguments are nonbinary strings, the result is a nonbinary string. If the
arguments include any binary strings, the result is a binary string. A numeric
argument is converted to its equivalent nonbinary string form.
Syntax : CONCAT(str1,str2,...)
Example : SELECT CONCAT('w3resource','.','com');
Output : w3resource.com

CONCAT_WS()

CONCAT_WS() stands for Concatenate With Separator and is a special form

of CONCAT(). The first argument is the separator for the rest of the
arguments. The separator is added between the strings to be concatenated.
The separator can be a string, as can the rest of the arguments. If the
separator is NULL, the result is NULL.
Syntax : CONCAT_WS(separator,str1,str2,...)
Example : SELECT CONCAT_WS(',','1st string','2nd string');
Output : 1st string,2nd string

ELT()

ELT() returns the Nth element of the list of strings: str1 if N = 1, str2 if N = 2,
and so on. Returns NULL if N is less than 1 or greater than the number of
arguments. ELT() is the complement of FIELD().
Syntax : ELT(N,str1,str2,str3,...)
Example : SELECT ELT(4,'this','is','the','elt');
Output : elt

EXPORT_SET()
Returns a string such that for every bit set in the value bits, you get an on
string and for every bit not set in the value, you get an off string.
Syntax : EXPORT_SET(bits,on,off[,separator[,number_of_bits]])
Example : SELECT EXPORT_SET(5,'Y','N',',',3);
Output : Y,N,Y

FIELD()

Returns the index (position) of str in the str1, str2, str3, ... list. Returns 0 if str
is not found.
Syntax : FIELD(str,str1,str2,str3,...)
Example : SELECT FIELD('ank', 'b', 'ank', 'of', 'monk');
Output : 2

FIND_IN_SET()

Returns a value in the range of 1 to N if the string str is in the string list strlist
consisting of N substrings. A string list is a string composed of substrings separated
by “,” characters.
Returns NULL if either argument is NULL. This function does not work properly if the
first argument contains a comma (“,”) character.
Syntax : FIND_IN_SET(str,strlist)
Example : SELECT FIND_IN_SET('ank','b,ank,of,monk');
Output : 2
FORMAT()

Formats the number X to a format like '#,###,###.##', rounded to D decimal

places, and returns the result as a string. If D is 0, the result has no decimal
point or fractional part.
Syntax : FORMAT(X,D)
Example : SELECT FORMAT(12332.123456, 4);
Output : 12,332.1235
Example : SELECT FORMAT(12332.1,4);
Output : 12,332.1000
Example : SELECT FORMAT(12332.2,0);
Output : 12,332

HEX()

MySQL HEX() returns a string representation of hexadecimal value of a decimal or

string value specified as argument.
If the argument is a string, each character in the argument is converted to two
hexadecimal digits.
If the argument is decimal, the function returns a hexadecimal string representation
of the argument , and treated as a longlong(BIGINT) number.
Syntax : HEX(str), HEX(N)
Example : SELECT HEX(157);
Output : 9D
INSERT()

Returns the string str, with the substring beginning at position pos and len
characters long replaced by the string newstr. Returns the original string if pos
is not within the length of the string. Replaces the rest of the string from
position pos if len is not within the length of the rest of the string.
Syntax : INSERT(str,pos,len,newstr)
Example : SELECT INSERT('Originalstring', 4, 5, ' insert ');
Output : Ori insert string
Example : SELECT INSERT('Originalstring', -3, 5, ' insert ');
Output : Originalstring

INSTR()

MySQL INSTR() takes a string and a substring of it as arguments, and returns

an integer which indicates the position of the first occurrence of the substring
within the string
Syntax : INSTR(str,substr)
Example : SELECT INSTR('myteststring','st');
Output : 5

LCASE()

MySQL LCASE() converts the characters of a string to lower case characters.

Syntax : LCASE(str)
Example : SELECT LCASE('MYTESTSTRING');
Output : myteststring

LEFT()

MySQL LEFT() returns a specified number of characters from the left of a

given string. Both the number and the string are supplied in the arguments as
str and len of the function.
Syntax : LEFT(str,len)
Example : SELECT LEFT('w3resource', 3);
Output : w3r

LENGTH()
MySQL LENGTH() returns the length of a given string.
Syntax : LENGTH(str)
Example : SELECT LENGTH('text');
Output : 4

LOCATE()

MySQL LOCATE() returns the position of the first occurrence of a string within
a string. Both of these strings are passed as arguments. An optional argument
may be used to specify from which position of the string (i.e. string to be
searched) searching will start. If this position is not mentioned, searching
starts from the beginning.
Syntax : LOCATE(substr,str,pos)
Example : SELECT LOCATE('st','myteststring');
Output : 5

LOWER()

MySQL LOWER() converts all the characters in a string to lowercase

characters.
Syntax : LOWER(str)
Example : SELECT LOWER('MYTESTSTRING');
Output : myteststring

LPAD()

MySQL LPAD() left pads a string with another string. The actual string, a
number indicating the length of the padding in characters (optional) and the
string to be used for left padding - all are passed as arguments.
Syntax : LPAD(str,len,padstr)
Example : SELECT LPAD('Hello',10,'*');
Output : *****Hello
Example : SELECT LPAD('hi',1,'**');
Output : h

LTRIM(str)

MySQL LTRIM() removes the leading space characters of a string passed as

argument.
Syntax : LTRIM(str)
Example : SELECT LTRIM(' Hello')
Output : Hello ( leading spaces have been exclude)

MAKE_SET()

MySQL MAKE_SET() returns a set value (a string containing substrings

separated by “,” characters) consisting of the strings that have the
corresponding bit in the first argument.
Syntax : MAKE_SET(bits,str1,str2,...)
Example : SELECT MAKE_SET(1,'a','b','c');
Output : a
Example : SELECT MAKE_SET(1 | 4,'hello','nice',NULL,'world');
Output : hello

MID()

MySQL MID() extracts a substring from a string. The actual string, position to
start extraction and length of the extracted string - all are specified as
arguments.
Syntax : MID(str,pos,len)
Example : SELECT MID('w3resource',4,3);
Output : eso

OCT()

Returns a string representation of the octal value of N, where N is a longlong

(BIGINT) number. Returns NULL if N is NULL.
Syntax : OCT(N)
Example : SELECT OCT(12);
Output : 14

ORD()

MySQL ORD() returns the code for the leftmost character if that character is a
multi-byte (sequence of one or more bytes) one. If the leftmost character is not
a multibyte character, ORD() returns the same value as the ASCII() function.
Syntax : ORD(str)
Example : SELECT ORD("w3resource");
Output : 119

POSITION()
MySQL POSITION() returns the position of a substring within a string..
Syntax : POSITION(substr IN str)
Example : SELECT POSITION("ou" IN "w3resource");
Output : 6

QUOTE()

Quotes a string to produce a result that can be used as a properly escaped

data value in an SQL statement. The string is returned enclosed by single
quotation marks and with each instance of backslash (“\”), single quote (“'”),
ASCII NUL, and Control+Z preceded by a backslash. If the argument is NULL,
the return value is the word “NULL” without enclosing single quotation marks.
Syntax : QUOTE(str)
Example : SELECT QUOTE('w3re''source');
Output : 'w3re\'source'

REPEAT()

MySQL REPEAT() repeats a string for a specified number of times.

The function returns NULL either any either of the arguments are NULL.
Syntax : REPEAT(str,count)
Example : SELECT REPEAT('**-',5);
Output : **-**-**-**-**-

REPLACE()

MySQL REPLACE() replaces all the occurrences of a substring within a string.

Syntax : REPLACE(str,from_str,to_str)
Example : SELECT REPLACE('w3resource','ur','r');
Output : w3resorce

REVERSE()

Returns a given string with the order of the characters reversed.

Syntax : REVERSE(str)
Example : SELECT REVERSE('w3resource');
Output : ecruoser3w

RIGHT()

MySQL RIGHT() extracts a specified number of characters from the right side
of a given string.
Syntax : RIGHT(str,len)
Example : SELECT RIGHT('w3resource',8);
Output : resource

RPAD()

MySQL RPAD() function pads strings from right. The actual string which is to
be padded as str, length of the string returned after padding as len and string
which is used for padding as padstr is used as a parameters within the
argument.
Syntax : RPAD(str,len,padstr)
Example : SELECT RPAD('w3resource',15,'*');
Output : w3resource*****

RTRIM()

MySQL RTRIM() removes the trailing spaces from a given string.

Syntax : RTRIM(str)
Example : SELECT RTRIM('w3resource ');
(excludes the trailing spaces) Output : w3resource

SOUNDEX()

MySQL SOUNDEX() function returns soundex string of a string.

Soundex is a phonetic algorithm for indexing names after English
pronunciation of sound. You can use SUBSTRING() on the result to get a
standard soundex string. All non-alphabetic characters in str are ignored. All
international alphabetic characters outside the A-Z range are treated as
vowels.
Syntax : SOUNDEX(str)
Example : SELECT SOUNDEX('w3resource');
Output : w6262

SPACE()

MySQL SPACE() returns the string containing a number of spaces as

specified in the argument.
Syntax : SPACE(N)
Example : SELECT 'start', SPACE(10), 'end';
Output : start end SPACE(10)
SUBSTR()

MySQL SUBSTR() returns the specified number of characters from a

particular position of a given string. SUBSTR() is a synonym for
SUBSTRING().
Syntax : SUBSTR(str,pos,len)
Example : SELECT SUBSTR('w3resource',4,3);
Output : eso

SUBSTRING()

MySQL SUBSTRING() returns a specified number of characters from a

particular position of a given string.
Syntax : SUBSTRING(str,pos,len)
Example : SELECT SUBSTRING('w3resource',4,3);
Output : eso
Example : SELECT SUBSTRING('w3resource.com',5);
Output : source.com
Example : SELECT SUBSTRING('w3resource.com',-5);
Output : e.com

SUBSTRING_INDEX()

MySQL SUBSTRING_INDEX() returns the substring from the given string

before a specified number of occurrences of a delimiter.
Returns from the left of the final delimiter if the number is positive and right of
the final delimiter when the number is negative.
If the number is greater than the number of occurrence of delimiter, the
returned substring will be the total string. If the specified number is 0, nothing
will be fetched from the given string.
Syntax : SUBSTRING_INDEX(str,delim,count)
Example : SELECT SUBSTRING_INDEX('www.mytestpage.info','.',2);
Output : www.mytestpage

TRIM()

MySQL TRIM() function returns a string after removing all prefixes or suffixes
from the given string.
Syntax : TRIM([{BOTH | LEADING | TRAILING} [remstr] FROM] str)
Example : SELECT TRIM(' trim ');
Output : trim (leading and trailing space removed)
Example : SELECT TRIM(LEADING 'leading' FROM 'leadingtext' );
Output : text
Example : SELECT TRIM(BOTH 'leadtrail' FROM 'leadtrailtextleadtrail');
Output : text

UNHEX()

MySQL UNHEX() function performs the opposite operation of HEX(). This

function interprets each pair of hexadecimal digits (in the argument) as a
number and converts it to a character.
Syntax : UNHEX(str)
Example : SELECT UNHEX('4D7953514C');
Output : MySQL
Example : SELECT UNHEX(HEX('MySQL'));
Output : MySQL

UPPER()

MySQL UPPER() converts all the characters in a string to uppercase

characters.
Syntax : UPPER(str)
Example : SELECT UPPER('myteststring');
Output : MYTESTSTRING

To find nth Highest record

Note : OFFSET starts from 0th position, and hence use N-1 rule here
---------to find nth Salary: (offset will skip the rows counting starts with 0 hence use n-1)

SELECT DISTINCT Salary FROM emp ORDER BY Salary DESC LIMIT 1 OFFSET (n-1)

----------- to find 8th highest salary:

SELECT DISTINCT Salary FROM emp ORDER BY Salary DESC LIMIT 1 OFFSET 7

----------to find first 10 rows

Select *

from emp

limit 10;
---------to find rows starting from 3 rd onward 7 rows (counting starts with 0)

Select *

from emp

limit 3,7

Data types in mysql

• Numeric

• Date and Time

• String Types.

Let us now discuss them in detail.

Numeric Data Types

MySQL uses all the standard ANSI SQL numeric data types, so if you're coming to MySQL from a
different database system, these definitions will look familiar to you. The following list shows the
common numeric data types and their descriptions −

• INT − A normal-sized integer that can be signed or unsigned. If signed, the allowable range is
from -2147483648 to 2147483647. If unsigned, the allowable range is from 0 to
4294967295. You can specify a width of up to 11 digits.

• TINYINT − A very small integer that can be signed or unsigned. If signed, the allowable range
is from -128 to 127. If unsigned, the allowable range is from 0 to 255. You can specify a
width of up to 4 digits.

• SMALLINT − A small integer that can be signed or unsigned. If signed, the allowable range is
from -32768 to 32767. If unsigned, the allowable range is from 0 to 65535. You can specify a
width of up to 5 digits.

• MEDIUMINT − A medium-sized integer that can be signed or unsigned. If signed, the

allowable range is from -8388608 to 8388607. If unsigned, the allowable range is from 0 to
16777215. You can specify a width of up to 9 digits.

• BIGINT − A large integer that can be signed or unsigned. If signed, the allowable range is
from -9223372036854775808 to 9223372036854775807. If unsigned, the allowable range is
from 0 to 18446744073709551615. You can specify a width of up to 20 digits.

• FLOAT(M,D) − A floating-point number that cannot be unsigned. You can define the display
length (M) and the number of decimals (D). This is not required and will default to 10,2,
where 2 is the number of decimals and 10 is the total number of digits (including decimals).
Decimal precision can go to 24 places for a FLOAT.

• DOUBLE(M,D) − A double precision floating-point number that cannot be unsigned. You can
define the display length (M) and the number of decimals (D). This is not required and will
 default to 16,4, where 4 is the number of decimals. Decimal precision can go to 53 places for
a DOUBLE. REAL is a synonym for DOUBLE.

• DECIMAL(M,D) − An unpacked floating-point number that cannot be unsigned. In the

unpacked decimals, each decimal corresponds to one byte. Defining the display length (M)
and the number of decimals (D) is required. NUMERIC is a synonym for DECIMAL.

Date and Time Types

The MySQL date and time datatypes are as follows −

• DATE − A date in YYYY-MM-DD format, between 1000-01-01 and 9999-12-31. For example,
December 30th, 1973 would be stored as 1973-12-30.

• DATETIME − A date and time combination in YYYY-MM-DD HH:MM:SS format, between

1000-01-01 00:00:00 and 9999-12-31 23:59:59. For example, 3:30 in the afternoon on
December 30th, 1973 would be stored as 1973-12-30 15:30:00.

• TIMESTAMP − A timestamp between midnight, January 1st, 1970 and sometime in 2037. This
looks like the previous DATETIME format, only without the hyphens between numbers; 3:30
in the afternoon on December 30th, 1973 would be stored as 19731230153000 (
YYYYMMDDHHMMSS ).

• TIME − Stores the time in a HH:MM:SS format.

• YEAR(M) − Stores a year in a 2-digit or a 4-digit format. If the length is specified as 2 (for
example YEAR(2)), YEAR can be between 1970 to 2069 (70 to 69). If the length is specified as
4, then YEAR can be 1901 to 2155. The default length is 4.

String Types

Although the numeric and date types are fun, most data you'll store will be in a string format. This
list describes the common string datatypes in MySQL.

• CHAR(M) − A fixed-length string between 1 and 255 characters in length (for example
CHAR(5)), right-padded with spaces to the specified length when stored. Defining a length is
not required, but the default is 1.

• VARCHAR(M) − A variable-length string between 1 and 255 characters in length. For

example, VARCHAR(25). You must define a length when creating a VARCHAR field.

• BLOB or TEXT − A field with a maximum length of 65535 characters. BLOBs are "Binary Large
Objects" and are used to store large amounts of binary data, such as images or other types
of files. Fields defined as TEXT also hold large amounts of data. The difference between the
two is that the sorts and comparisons on the stored data are case sensitive on BLOBs and
are not case sensitive in TEXT fields. You do not specify a length with BLOB or TEXT.

• TINYBLOB or TINYTEXT − A BLOB or TEXT column with a maximum length of 255 characters.
You do not specify a length with TINYBLOB or TINYTEXT.

• MEDIUMBLOB or MEDIUMTEXT − A BLOB or TEXT column with a maximum length of

16777215 characters. You do not specify a length with MEDIUMBLOB or MEDIUMTEXT.

• LONGBLOB or LONGTEXT − A BLOB or TEXT column with a maximum length of 4294967295

characters. You do not specify a length with LONGBLOB or LONGTEXT.
 • ENUM − An enumeration, which is a fancy term for list. When defining an ENUM, you are
creating a list of items from which the value must be selected (or it can be NULL). For
example, if you wanted your field to contain "A" or "B" or "C", you would define your ENUM
as ENUM ('A', 'B', 'C') and only those values (or NULL) could ever populate that field.

To create table
-------------------
1. CREATE TABLE IF NOT EXISTS newpublisher
(pub_id varchar(8) NOT NULL UNIQUE DEFAULT '' ,
pub_name varchar(50) NOT NULL DEFAULT '' ,
pub_city varchar(25) NOT NULL DEFAULT '' ,
country varchar(25) NOT NULL DEFAULT 'India',
country_office varchar(25) ,
no_of_branch int(3),
pub_date date
CHECK ((country='India' AND pub_city='Mumbai')
OR (country='India' AND pub_city='New Delhi')) ,
PRIMARY KEY (pub_id));

2. CREATE TABLE IF NOT EXISTS newauthor

(id int NOT NULL AUTO_INCREMENT,

aut_id varchar(8),

aut_name varchar(50),

country varchar(25),

home_city varchar(25) NOT NULL,

PRIMARY KEY (id));

Using Forign key in mysql

CONSTRAINT constraint_name

FOREIGN KEY foreign_key_name (columns)

REFERENCES parent_table(columns)

ON DELETE action

ON UPDATE action

Action

The ON DELETE clause allows you to

define what happens to the records in
the child table when the records in the
parent table are deleted. If you omit the
ON DELETE clause and delete a record
in the parent table that has records in
the child table refer to, MySQL will
reject the deletion.

ON DELETE CASCADE delete records in the child table that

refers to a record in the parent table
when the record in the parent table is
deleted

ON DELETE SET NULL set the foreign key column values in the
child table to NULL

ON DELETE NO ACTION or ON will reject the deletion.

DELETE RESTRICT

Let’s examine the syntax in greater detail:

The CONSTRAINT clause allows you to define constraint name for the foreign key
constraint. If you omit it, MySQL will generate a name automatically.

The FOREIGN KEY clause specifies the columns in the child table that refers to
primary key columns in the parent table. You can put a foreign key name after
FOREIGN KEY clause or leave it to let MySQL create a name for you. Notice that
MySQL automatically creates an index with the foreign_key_name name.

The REFERENCES clause specifies the parent table and its columns to which the
columns in the child table refer. The number of columns in the child table and parent
table specified in the FOREIGN KEY and REFERENCES must be the same.

Examples:

CREATE DATABASE IF NOT EXISTS dbdemo;

USE dbdemo;

CREATE TABLE categories(

cat_id int not null auto_increment primary key,

cat_name varchar(255) not null,

cat_description text

);

CREATE TABLE products(

prd_id int not null auto_increment primary key,

prd_name varchar(355) not null,

prd_price decimal,
 cat_id int not null,

FOREIGN KEY fk_cat(cat_id)

REFERENCES categories(cat_id)

ON UPDATE CASCADE

ON DELETE RESTRICT

)ENGINE=InnoDB;

To delete unique constraint ----delete index will delete the

constraint
create table unique_constraints(unid int,activity_name varchar(100),CONSTRAINT
activty_uqniue UNIQUE(activity_name),primary key (unid));

alter table unique_constraints

drop index activty_uqniue; ---------------delete unique constraint

To delete constraint
ALTER TABLE `table_name` DROP FOREIGN KEY `id_name_fk`;

ALTER TABLE `table_name` DROP INDEX `id_name_fk`;

To add constraint in existing table

Lets create properties and user table and then add constraint in user table

CREATE TABLE Properties

ID int AUTO_INCREMENT,

language int,

stonecolor int,

gamefield int,
 UserID int,

PRIMARY KEY(ID),

FOREIGN KEY(language) REFERENCES Language(ID),

FOREIGN KEY(stonecolor) REFERENCES StoneColor(ID),

FOREIGN KEY(gamefield) REFERENCES GameField(ID)

) ENGINE = INNODB;

CREATE TABLE User

ID int AUTO_INCREMENT,

vorname varchar(30) NOT NULL,

name varchar(30) NOT NULL,

email varchar(40) NOT NULL,

password varchar(40) NOT NULL,

nickname varchar(15) NOT NULL,

score int,

isadmin int DEFAULT 0,

gamesPlayed int,

properties int NOT NULL,

PRIMARY KEY(ID),

UNIQUE (email),

UNIQUE (nickname)
) ENGINE = INNODB;

To alter table
------------ To add constraint
ALTER TABLE User

ADD CONSTRAINT userProperties

FOREIGN KEY(properties)

REFERENCES Properties(ID)

------------ To add a column

Add column in table

Syntax

------The syntax to add a column in a table in MySQL (using the ALTER

TABLE statement) is:

ALTER TABLE table_name

ADD new_column_name column_definition

[ FIRST | AFTER column_name ];

Add multiple columns in table

Syntax

---------The syntax to add multiple columns in a table in MySQL (using the

ALTER TABLE statement) is:

ALTER TABLE table_name

ADD new_column_name column_definition

 [ FIRST | AFTER column_name ],

ADD new_column_name column_definition

[ FIRST | AFTER column_name ],

...

Example
-------To add lastname column after contacted

ALTER TABLE contacts

ADD lastname varchar(40) NOT NULL

AFTER contactid;

-------To add multiple columns

ALTER TABLE contacts

ADD lastname varchar(40) NOT NULL

FIRST,

ADD first_name varchar(35) NULL

AFTER last_name;

------------ To modify a column

Modify column in table

Syntax

The syntax to modify a column in a table in MySQL (using the ALTER TABLE
statement) is:

ALTER TABLE table_name

 MODIFY column_name column_definition

[ FIRST | AFTER column_name ];

Example:

ALTER TABLE contacts

MODIFY last_name varchar(50) NULL;

-------To drop column

ALTER TABLE table_name
DROP COLUMN column_name;

Example:
ALTER TABLE contacts
DROP COLUMN contact_type;

---------- To rename column

ALTER TABLE table_name
CHANGE COLUMN old_name new_name
column_definition
[ FIRST | AFTER column_name ]
Example: To rename the column contact_type to ctype.

ALTER TABLE contacts

CHANGE COLUMN contact_type ctype
varchar(20) NOT NULL;
-------To Rename table
Syntax
The syntax to rename a table in MySQL is:
ALTER TABLE table_name
RENAME TO new_table_name;
Example:
ALTER TABLE contacts
RENAME TO people;

Create index

CREATE UNIQUE INDEX newautid ON newauthor(aut_id);

Create index salidx on emp(sal);

Consider two ways of doing the same thing:

PreparedStatement stmt = conn.createStatement("INSERT INTO students VALUES('" + user + "')");

stmt.execute();
If "user" came from user input and the user input was

Robert'); DROP TABLE students; --

Then in the first instance, you'd be hosed.

SQL injection through stored procedure in mysql

delimiter //

create procedure myproc123(empname varchar(200))

begin

declare sqldata varchar(200);

set sqldata='select * from emp where';

if empname is not null then

set sqldata=concat(sqldata,' ename like ''',empname);

end if;
 select sqldata;

PREPARE stmt3 FROM @sqldata;

EXECUTE stmt3;

DEALLOCATE PREPARE stmt3;

end//

delimiter ;

call myproc123('1'' or ''1''=''1''’);

Bypass authentication

Select * from users where username= ‘aaa’ and password=’shfjh’ or 6=6;

Introduction
MySQL is an open-source database management software that helps users store,
organize, and later retrieve data. It has a variety of options to grant specific users
nuanced permissions within the tables and databases—this tutorial will give a short
overview of a few of the many options.

What the Highlights Mean

Throughout this tutorial, any lines that the user needs to enter or customize will
be highlighted! The rest should mostly be copy-and-pastable.

How to Create a New User

we did all of the editing in MySQL as the root user, with full access to all of the
databases. However, in cases where more restrictions may be required, there are
ways to create users with custom permissions.
 Let’s start by making a new user within the MySQL shell:

• CREATE USER 'user1'@'localhost' IDENTIFIED BY 'user1';

•

Note: When adding users within the MySQL shell in this tutorial, we will specify the
user’s host as localhost and not the server’s IP address. localhost is a hostname
which means “this computer,” and MySQL treats this particular hostname specially:
when a user with that host logs into MySQL it will attempt to connect to the local server
by using a Unix socket file. Thus, localhost is typically used when you plan to connect
by SSHing into your server or when you’re running the local mysql client to connect to
the local MySQL server.

At this point user1 has no permissions to do anything with the databases. In fact,
even if user tries to login (with the password, password), they will not be able to
reach the MySQL shell.

Therefore, the first thing to do is to provide the user with access to the information
they will need.

• GRANT ALL PRIVILEGES ON * . * TO 'user1'@'localhost';

•

The asterisks in this command refer to the database and table (respectively) that
they can access—this specific command allows to the user to read, edit, execute
and perform all tasks across all the databases and tables.

Please note that in this example we are granting user1 full root access to everything
in our database. While this is helpful for explaining some MySQL concepts, it may be
impractical for most use cases and could put your database’s security at high risk.

Once you have finalized the permissions that you want to set up for your new users,
always be sure to reload all the privileges.

• FLUSH PRIVILEGES;
•

Your changes will now be in effect.

How To Grant Different User Permissions

Here is a short list of other common possible permissions that users
can enjoy.

• ALL PRIVILEGES- as we saw previously, this would allow a MySQL

user full access to a designated database (or if no database is
selected, global access across the system)
• CREATE- allows them to create new tables or databases
 • DROP- allows them to them to delete tables or databases
• DELETE- allows them to delete rows from tables
• INSERT- allows them to insert rows into tables
• SELECT- allows them to use the SELECT command to read through
databases
• UPDATE- allow them to update table rows
• GRANT OPTION- allows them to grant or remove other users'
privileges

To provide a specific user with a permission, you can use this

framework:

• GRANT type_of_permission ON database_name.table_name TO

‘username’@'localhost’;
•
• 1. To assign select permission to user1 foe users table from test
database.

grant select on test.users to ‘user1’@’localhost’

If you want to give them access to any database or to any table, make
sure to put an asterisk (*) in the place of the database name or table
name.

Each time you update or change a permission be sure to use the Flush
Privileges command.

If you need to revoke a permission, the structure is almost identical

to granting it:

• REVOKE type_of_permission ON database_name.table_name FROM

‘username’@‘localhost’;
•

Note that when revoking permissions, the syntax requires that you
use FROM, instead of TO as we used when granting permissions.

You can review a user’s current permissions by running the following:

SHOW GRANTS for ‘username’@’localhost’;

SHOW GRANTS for ‘user1’@’localhost’;

Just as you can delete databases with DROP, you can use DROP to delete
a user altogether:

• DROP USER ‘username’@‘localhost’;

•

To test out your new user, log out by typing:

• quit
•

and log back in with this command in terminal:

• mysql -u [username] -p

mysql -u user1 -p
enter password: