Administering User Accounts and Privileges in MySQL
Jul 10, 2025 pm 01:22 PMCreating, managing and deleting MySQL users and permissions must follow the principle of minimum permissions to ensure security. 1. Create a user to use CREATE USER and specify the host and password plug-in; 2. Assign SELECT, INSERT and other permissions as needed when granting permissions, and use FLUSH PRIVILEGES to take effect; 3. Recycle permissions or reset permissions through REVOKE; 4. Delete users to use DROP USER to clean up in time to reduce risks; at the same time pay attention to the compatibility issues of remote access protection and client.
Managing MySQL user accounts and permissions is actually not complicated, but many people who are new to database operations and maintenance are prone to traps in this area. The key is to understand the basic logic of the permission system and how to allocate account permissions safely and effectively.

Create a user: Start with the basics
MySQL user account consists of a user name and a host name, in the format 'user'@'host'
. Creating a user statement is also very simple:

CREATE USER 'new_user'@'localhost' IDENTIFIED BY 'password';
If you want this user to log in from any IP, you can change localhost
to %
:
CREATE USER 'remote_user'@'%' IDENTIFIED BY 'secure_password';
However, it should be noted that while allowing remote access, you must also ensure that your MySQL service is protected by firewalls, otherwise it will be easily attacked.

In addition, MySQL 8.0 has started to use the caching_sha2_password
plug-in by default for authentication, and some old clients may not support it. If you encounter connection problems, you can manually specify mysql_native_password
:
CREATE USER 'old_client_user'@'%' IDENTIFIED WITH mysql_native_password BY 'pass123';
Assign permissions: on-demand authorization, minimized principle
When granting permissions to users, it is recommended to follow the principle of "minimum permissions" and only open necessary permissions to avoid the risks brought about by excessive authorization.
Common permissions include:
-
SELECT
: Query data -
INSERT
: Insert data -
UPDATE
: Update data -
DELETE
: Delete data -
CREATE
: Create a table or database -
DROP
: Delete tables or databases -
GRANT OPTION
: Grant or revoke permissions from other users
For example, if you want a user to only operate tables in a certain database, you can authorize it like this:
GRANT SELECT, INSERT ON mydb.* TO 'limited_user'@'%';
Don't forget to refresh the permissions after executing the permissions:
FLUSH PRIVILEGES;
Sometimes you will find that the permissions are not effective, it may be because you forgot to refresh, or it may be because the scope of the permissions is incorrect (for example, you gave permissions to a certain library, but the user used another library).
Modification and recycling permissions: Flexible adjustment
As business changes, user permissions also need to be adjusted dynamically. You can use GRANT
to increase permissions, or you can use REVOKE
to recycle permissions.
For example, if you want to revoke the delete permission of a user to a table:
REVOKE DELETE ON mydb.mytable FROM 'limited_user'@'%';
If you find that a user has too many permissions and want to reset the permissions, you can first REVOKE ALL
and then reassign:
REVOKE ALL PRIVILEGES ON *.* FROM 'user_to_reset'@'%'; FLUSH PRIVILEGES;
Note: This does not delete the user itself, it just clears all permissions.
Delete users: Clean up accounts that are no longer needed in time
When a user no longer needs to access the database, it should be deleted in time to avoid leaving any security risks.
The command to delete a user is simple:
DROP USER 'old_user'@'localhost';
This operation will delete all permission records of the user at the same time. If you want to confirm whether the user exists, you can first check mysql.user
table:
SELECT User, Host FROM mysql.user;
However, don't change this table directly. It is recommended to use commands such as CREATE USER
, GRANT
and DROP USER
to manage users and permissions, which is safer and more standardized.
Basically that's it. Creation, authorization, adjustment, and deletion, the whole process looks quite intuitive, but in actual operation, you should pay special attention to the scope of permissions and the compatibility of password plug-in. As long as you follow the principle of minimum authority, most security risks can be controlled.
The above is the detailed content of Administering User Accounts and Privileges in MySQL. For more information, please follow other related articles on the PHP Chinese website!

Hot AI Tools

Undress AI Tool
Undress images for free

Undresser.AI Undress
AI-powered app for creating realistic nude photos

AI Clothes Remover
Online AI tool for removing clothes from photos.

Clothoff.io
AI clothes remover

Video Face Swap
Swap faces in any video effortlessly with our completely free AI face swap tool!

Hot Article

Hot Tools

Notepad++7.3.1
Easy-to-use and free code editor

SublimeText3 Chinese version
Chinese version, very easy to use

Zend Studio 13.0.1
Powerful PHP integrated development environment

Dreamweaver CS6
Visual web development tools

SublimeText3 Mac version
God-level code editing software (SublimeText3)

Hot Topics

1. The first choice for the Laravel MySQL Vue/React combination in the PHP development question and answer community is the first choice for Laravel MySQL Vue/React combination, due to its maturity in the ecosystem and high development efficiency; 2. High performance requires dependence on cache (Redis), database optimization, CDN and asynchronous queues; 3. Security must be done with input filtering, CSRF protection, HTTPS, password encryption and permission control; 4. Money optional advertising, member subscription, rewards, commissions, knowledge payment and other models, the core is to match community tone and user needs.

There are three ways to connect Excel to MySQL database: 1. Use PowerQuery: After installing the MySQLODBC driver, establish connections and import data through Excel's built-in PowerQuery function, and support timed refresh; 2. Use MySQLforExcel plug-in: The official plug-in provides a friendly interface, supports two-way synchronization and table import back to MySQL, and pay attention to version compatibility; 3. Use VBA ADO programming: suitable for advanced users, and achieve flexible connections and queries by writing macro code. Choose the appropriate method according to your needs and technical level. PowerQuery or MySQLforExcel is recommended for daily use, and VBA is better for automated processing.

There are three main ways to set environment variables in PHP: 1. Global configuration through php.ini; 2. Passed through a web server (such as SetEnv of Apache or fastcgi_param of Nginx); 3. Use putenv() function in PHP scripts. Among them, php.ini is suitable for global and infrequently changing configurations, web server configuration is suitable for scenarios that need to be isolated, and putenv() is suitable for temporary variables. Persistence policies include configuration files (such as php.ini or web server configuration), .env files are loaded with dotenv library, and dynamic injection of variables in CI/CD processes. Security management sensitive information should be avoided hard-coded, and it is recommended to use.en

To achieve MySQL deployment automation, the key is to use Terraform to define resources, Ansible management configuration, Git for version control, and strengthen security and permission management. 1. Use Terraform to define MySQL instances, such as the version, type, access control and other resource attributes of AWSRDS; 2. Use AnsiblePlaybook to realize detailed configurations such as database user creation, permission settings, etc.; 3. All configuration files are included in Git management, support change tracking and collaborative development; 4. Avoid hard-coded sensitive information, use Vault or AnsibleVault to manage passwords, and set access control and minimum permission principles.

To collect user behavior data, you need to record browsing, search, purchase and other information into the database through PHP, and clean and analyze it to explore interest preferences; 2. The selection of recommendation algorithms should be determined based on data characteristics: based on content, collaborative filtering, rules or mixed recommendations; 3. Collaborative filtering can be implemented in PHP to calculate user cosine similarity, select K nearest neighbors, weighted prediction scores and recommend high-scoring products; 4. Performance evaluation uses accuracy, recall, F1 value and CTR, conversion rate and verify the effect through A/B tests; 5. Cold start problems can be alleviated through product attributes, user registration information, popular recommendations and expert evaluations; 6. Performance optimization methods include cached recommendation results, asynchronous processing, distributed computing and SQL query optimization, thereby improving recommendation efficiency and user experience.

PHP plays the role of connector and brain center in intelligent customer service, responsible for connecting front-end input, database storage and external AI services; 2. When implementing it, it is necessary to build a multi-layer architecture: the front-end receives user messages, the PHP back-end preprocesses and routes requests, first matches the local knowledge base, and misses, call external AI services such as OpenAI or Dialogflow to obtain intelligent reply; 3. Session management is written to MySQL and other databases by PHP to ensure context continuity; 4. Integrated AI services need to use Guzzle to send HTTP requests, safely store APIKeys, and do a good job of error handling and response analysis; 5. Database design must include sessions, messages, knowledge bases, and user tables, reasonably build indexes, ensure security and performance, and support robot memory

To recycle MySQL user permissions using REVOKE, you need to specify the permission type, database, and user by format. 1. Use REVOKEALLPRIVILEGES, GRANTOPTIONFROM'username'@'hostname'; 2. Use REVOKEALLPRIVILEGESONmydb.FROM'username'@'hostname'; 3. Use REVOKEALLPRIVILEGESONmydb.FROM'username'@'hostname'; 3. Use REVOKE permission type ON.*FROM'username'@'hostname'; Note that after execution, it is recommended to refresh the permissions. The scope of the permissions must be consistent with the authorization time, and non-existent permissions cannot be recycled.

To enable PHP containers to support automatic construction, the core lies in configuring the continuous integration (CI) process. 1. Use Dockerfile to define the PHP environment, including basic image, extension installation, dependency management and permission settings; 2. Configure CI/CD tools such as GitLabCI, and define the build, test and deployment stages through the .gitlab-ci.yml file to achieve automatic construction, testing and deployment; 3. Integrate test frameworks such as PHPUnit to ensure that tests are automatically run after code changes; 4. Use automated deployment strategies such as Kubernetes to define deployment configuration through the deployment.yaml file; 5. Optimize Dockerfile and adopt multi-stage construction
