def dict_to_mysql_cli_args(d):
    """Convert a dict into a list of args to the MySQL Client CLI.

    The global my.cnf file is explicitly ignored if 'read_default_file' is not
    in d.

    If 'passwd' is in d, the password will be passed on the command line, which
    means that other users will be able to see it.

    NEVER USE THIS FUNCTION WITH UNTRUSTED INPUT!

    >>> dict_to_mysql_cli_args({'host': 'localhost'})
    ['--defaults-file=', '-h', 'localhost']
    >>> dict_to_mysql_cli_args({'host': 'localhost', 'port': 123})
    ['--defaults-file=', '-h', 'localhost', '-P', '123']
    >>> dict_to_mysql_cli_args({'host': 'localhost', 'port': 123, 'db': 'Blah'})
    ['--defaults-file=', '-h', 'localhost', '-P', '123', 'Blah']
    >>> dict_to_mysql_cli_args({'host': 'localhost', 'port': 123, 'db': 'Blah', 'read_default_file': '~/.my.cnf'})
    ['--defaults-file=~/.my.cnf', '-h', 'localhost', '-P', '123', 'Blah']
    >>> dict_to_mysql_cli_args({'host': 'localhost', 'port': 123, 'db': 'Blah', 'user': 'person'})
    ['--defaults-file=', '-h', 'localhost', '-P', '123', '-u', 'person', 'Blah']
    >>> dict_to_mysql_cli_args({'host': 'localhost', 'port': 123, 'db': 'Blah', 'user': 'person', 'passwd': 'goldfish'})
    ['--defaults-file=', '-h', 'localhost', '-P', '123', '-u', 'person', '--password=goldfish', 'Blah']
    """
    args = []
    args.append('--defaults-file={}'.format(d.get('read_default_file', '')))
    if 'host' in d:
        args.extend(['-h', d['host']])
    if 'port' in d:
        args.extend(['-P', str(d['port'])])
    if 'user' in d:
        args.extend(['-u', d['user']])
    if 'passwd' in d:
        args.append('--password={}'.format(d['passwd']))
    if 'db' in d:
        args.append(d['db'])
    return args