Recently I experimented with column-level privileges in MySQL. Column-level privileges are fairly straightforward, but given how infrequently they are used I think there are a few areas worth discussing.
Here are a few high-level observations:
- Users can execute
INSERTandUPDATEstatements that affect columns they don't have privileges on, as long as they rely on implicit defaults - Since SQL is row-based, it doesn't make sense to support
column-level
DELETEprivileges, thus onlySELECT,INSERT, andUPDATEare supported - You can grant privileges on multiple columns in one
GRANTstatement or multipleGRANTstatements, the results are cumulative
Read on for more details on each type of …
[Read more]