REPLACE Statement that would tell the client program to transfer a file of the server’s choosing rather than the file named by the client in the  LOAD XML  statement. Such a server could access any file on the client host to which the client user has read access. In a Web environment, clients usually connect to MySQL from a Web server. A user that can run any command against the MySQL server can use  LOAD XML LOCAL  to read any files to which the Web server process has read access. In this environment, the client with respect to the MySQL server is actually the Web server, not the remote program being run by the user who connects to the Web server. You can disable loading of XML files from clients by starting the server with  --local-infile=0  or  -- local-infile=OFF . This option can also be used when starting the  mysql  client to disable  LOAD XML for the duration of the client session. To prevent a client from loading XML files from the server, do not grant the  FILE  privilege to the corresponding MySQL user account, or revoke this privilege if the client user account already has it. Important Revoking the  FILE  privilege (or not granting it in the first place) keeps the user only from executing the  LOAD XML  statement (as well as the  LOAD_FILE()  function; it does  not  prevent the user from executing  LOAD XML LOCAL . To disallow this statement, you must start the server or the client with  --local-infile=OFF . In other words, the  FILE  privilege affects only whether the client can read files on the server; it has no bearing on whether the client can read files on the local file system. 13.2.9 REPLACE Statement REPLACE [LOW_PRIORITY | DELAYED] [INTO]  tbl_name [PARTITION ( partition_name  [,  partition_name ] ...)] [( col_name  [,  col_name ] ...)] { {VALUES | VALUE} ( value_list ) [, ( value_list )] ... | VALUES  row_constructor_list } REPLACE [LOW_PRIORITY | DELAYED] [INTO]  tbl_name [PARTITION ( partition_name  [,  partition_name ] ...)] SET  assignment_list REPLACE [LOW_PRIORITY | DELAYED] [INTO]  tbl_name [PARTITION ( partition_name  [,  partition_name ] ...)] [( col_name  [,  col_name ] ...)] {SELECT ... | TABLE  table_name } value : { expr  | DEFAULT} value_list : value  [,  value ] ... row_constructor_list : ROW( value_list )[, ROW( value_list )][, ...] assignment : col_name  =  value 2658