Description:
------------
similar to https://bugs.php.net/bug.php?id=72345

A DOS attack vector for SQL injections uses the mysql SELECT SLEEP() command, as it will block a PHP process which is waiting for the mysql result and also one connection to the database itself.

this renders this kind of attack as very effective because you easily can bring either apache/php or mysql above its processlimits.

Additionally the mysql version distributed with ubuntu12lts and ubuntu14lts is not recent enough to contain server side timouts on a per statement basis.

Test script:
---------------
<?php
$start = time();
set_time_limit(2);


    define("DB_HOSTNAME",                    "localhost");
    define("DB_USERNAME",                    "root");
    define("DB_PASSWORD",                    "");
    define("DB_NAME",                        "mysql");

$connection_id = mysql_connect(DB_HOSTNAME, DB_USERNAME, DB_PASSWORD, false);
mysql_query('SELECT SLEEP(5)', $connection_id);

$end = time();

echo $end - $start;

Expected result:
----------------
mysql query should be interrupted after 2 seconds with a fatal error

Actual result:
--------------
no error, no timeouts triggered.

echos "5"