[WesolyKubeczek]

On MySQL, you can run SLEEP() or BENCHMARK() as a read-only user to your heart's content. You cannot restrict access to these functions, and letting the wide internets play with them will bring your server to its knees by clogging up all connections and hogging up its CPUs.

[dllthomas]

I wasn't contradicting the bits about DOS attacks, which remain very much a concern, even when no one is malicious.

[derision]

Solution: Don't use MySQL

[WesolyKubeczek]

PostgreSQL's SQL is Turing-complete. Imagine the possibilities!

[eloff]

All rdbms have similar issues with built-in functions. Plus you can easily create pathological queries that do the same.