If the MySQL user has the FILE privilege and the PHP environment allows writing to the web directory, you can drop a PHP web shell.