Why the mysql user should have a mysql database privileges if it's very dangerous.
if my code is vulnerable to SQL Injection and the user have the privileges the attacker can upload directly his backdoor using INTO OUTFILE function, so how mysql privileges work ?
Fundamentally, most software these days is going to have a way of persisting data.
Normally persistence involves using a database system such as MySql.
The simple answer to your question is you cannot avoid it. But you can do things to mitigate and weaken the possible impacts of an attack.
Firstly, treat all user input as hostile. Sanitize and clean it before use. Second, act on the principle of least privilege. This means that if you have a search query that only needs to select from an indexed search table. Only give the user select permissions on that particular table. Don't grant it all permissions on all tables because if an injection vulnerability is found... SQL map cough. Then suddenly they can do pretty much what they want and sniff all of your tables out and extract lots of sensitive data.
Even if you have an SQL injection flaw in your code and the privileges of the db user allow SELECT INTO (and what prevents you to remove that privilege?) this doesn't mean that the user can upload a back door. In order to successfully install a back door the mysqld daemon would need a lot more, like write privileges in one of the directories that is used by the web server for php file execution, for instance. Or 2 or more additional flows like local file inclusion. If your web server is configured properly, this won't be the case. Just uploading a file doesn't help an attacker if he can't execute it.
But in general, of course the user that connects to the DB for reading and updating data should have minimal permissions, like all users shouldn't have more permissions than they need to do their job.
So the summary is that SQL injection and permission to SELECT INTO alone is not enough to compromise a box. On the other hand, minimal permissions for everyone are always a good thing.