> For the complete documentation index, see [llms.txt](https://mariadb.com/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://mariadb.com/docs/server/server-usage/user-defined-functions/user-defined-functions-security.md).

# User-Defined Functions Security

The MariaDB server imposes a number of limitations on [user-defined functions](/docs/server/server-usage/user-defined-functions.md) for security purposes.

* The `INSERT` privilege for the mysql database is required to run [CREATE FUNCTION](/docs/server/server-usage/user-defined-functions/create-function-udf.md), as a record are added to the [mysql.func-table](/docs/server/reference/system-tables/the-mysql-database-tables/mysql-func-table.md).
* The `DELETE` privilege for the mysql database is required to run [DROP FUNCTION](/docs/server/server-usage/user-defined-functions/drop-function-udf.md) as the corresponding record are removed from the [mysql.func-table](/docs/server/reference/system-tables/the-mysql-database-tables/mysql-func-table.md).
* UDF object files can only be placed in the plugin directory, as specified by the value of the [plugin\_dir](/docs/server/server-management/variables-and-modes/server-system-variables.md#plugin_dir) system variable.
* At least one symbol, beyond the required `x()` , corresponding to an SQL function `X()`, is required. These can be `x_init()`, `x_deinit()`, `xxx_reset()`, `x_clear()`, and `x_add()` functions (see [Creating User-defined Functions](/docs/server/server-usage/user-defined-functions/creating-user-defined-functions.md)). The [allow-suspicious-udfs](/docs/server/server-management/starting-and-stopping-mariadb/mariadbd-options.md#-allow-suspicious-udfs) mariadbd option (by default unset) provides a workaround, permitting only one symbol to be used. This is not recommended, as it opens the possibility of loading shared objects that are not legitimate user-defined functions.

<sub>*This page is licensed: CC BY-SA / Gnu FDL*</sub>

{% @marketo/form formId="4316" %}