PHP and MySQL Web Development 4th Ed-tqw-_darksiderg

Introducing MySQL’s Privilege System
223
Setting Up Users and Privileges
A MySQL system can have many users.The root user should generally be used for
administration purposes only, for security reasons. For each user who needs to use the
system, you need to set up an account and password.They do not need to be the same as
usernames and passwords outside MySQL (for example, Unix or NT usernames and
passwords).The same principle applies to root. Having different passwords for the system
and for MySQL is a good idea, especially when it comes to the root password.
Setting up passwords for users isn’t compulsory, but we strongly recommend that you
set up passwords for all the users you create. For the purposes of setting up a web database,
it’s a good idea to set up at least one user per web application.You might ask,“Why
would I want to do this?”The answer lies in privileges.
Introducing MySQL’s Privilege System
One of the best features of MySQL is that it supports a sophisticated privilege system. A
privilege is the right to perform a particular action on a particular object and is associated
with a particular user.The concept is similar to file permissions.When you create a user
within MySQL, you grant her a set of privileges to specify what she can and cannot do
within the system.
Principle of Least Privilege
The principle of least privilege can be used to improve the security of any computer
system. It’s a basic but important principle that is often overlooked.The principle is as
follows:
A user (or process) should have the lowest level of privilege required to perform his
assigned task.
It applies in MySQL as it does elsewhere. For example, to run queries from the Web, a
user does not need all the privileges to which root has access.You should therefore create
another user who has only the necessary privileges to access the database you just
created.
User Setup: The GRANT Command
The GRANT and REVOKE commands enable you to give rights to and take them away from
MySQL users at these four levels of privilege:
n Global
n Database
n Table
n Column