Why access control protects data in MySQL - See It in Action

Why Access Control Protects Data

📖 Scenario: You are managing a small company's database that stores employee information. To keep sensitive data safe, you need to control who can see or change the data.

🎯 Goal: Build a simple database table and set up access control by creating a user with limited permissions. This will show how access control protects data by restricting what users can do.

📋 What You'll Learn

Create a table called employees with columns id, name, and salary

Insert three employee records with exact values

Create a user called readonly_user with password 'readonlypass'

Grant only SELECT permission on the employees table to readonly_user

Demonstrate the permission by writing a query that readonly_user can run

💡 Why This Matters

🌍 Real World

Companies use access control to protect sensitive employee data from unauthorized changes or views.

💼 Career

Database administrators must know how to create users and assign permissions to keep data safe and comply with privacy rules.

1

Create the employees table and insert data

Write SQL statements to create a table called employees with columns id (integer), name (varchar 50), and salary (integer). Then insert these three rows exactly: (1, 'Alice', 70000), (2, 'Bob', 55000), and (3, 'Charlie', 60000).

MySQL

-- Your code here to create the employees table and insert data

Hint

Use CREATE TABLE to define the table and INSERT INTO to add rows.

2

Create a user with limited access

Write an SQL statement to create a user called readonly_user with password 'readonlypass'.

MySQL

CREATE TABLE employees (
  id INT,
  name VARCHAR(50),
  salary INT
);

INSERT INTO employees (id, name, salary) VALUES
(1, 'Alice', 70000),
(2, 'Bob', 55000),
(3, 'Charlie', 60000);

-- Your code here to create readonly_user

Hint

Use CREATE USER 'username'@'host' IDENTIFIED BY 'password' syntax.

3

Grant SELECT permission to the user

Write an SQL statement to grant only SELECT permission on the employees table to the user readonly_user.

MySQL

CREATE TABLE employees (
  id INT,
  name VARCHAR(50),
  salary INT
);

INSERT INTO employees (id, name, salary) VALUES
(1, 'Alice', 70000),
(2, 'Bob', 55000),
(3, 'Charlie', 60000);

CREATE USER 'readonly_user'@'localhost' IDENTIFIED BY 'readonlypass';

-- Your code here to grant SELECT permission

Hint

Use GRANT SELECT ON table TO user syntax.

4

Write a query to show data accessible by the user

Write a SQL query that the user readonly_user can run to see all employee names and salaries from the employees table.

MySQL

CREATE TABLE employees (
  id INT,
  name VARCHAR(50),
  salary INT
);

INSERT INTO employees (id, name, salary) VALUES
(1, 'Alice', 70000),
(2, 'Bob', 55000),
(3, 'Charlie', 60000);

CREATE USER 'readonly_user'@'localhost' IDENTIFIED BY 'readonlypass';

GRANT SELECT ON employees TO 'readonly_user'@'localhost';

-- Your code here to select name and salary

Hint

Use SELECT name, salary FROM employees; to view allowed data.

Practice

1. Why is access control important in a MySQL database?

easy

A. It limits who can view or change data, protecting it from unauthorized access.

B. It speeds up query execution by caching results.

C. It automatically backs up the database daily.

D. It formats the data for better display on websites.

Solution

1. Step 1: Understand the purpose of access control

   Access control restricts database access to authorized users only.

2. Step 2: Identify the benefit of restricting access

   By limiting who can view or modify data, it protects data from unauthorized changes or leaks.

3. Final Answer:

   It limits who can view or change data, protecting it from unauthorized access. -> Option A

4. Quick Check:

   Access control = Protects data [OK]

Hint: Access control means who can do what with data [OK]

Common Mistakes:

• Confusing access control with performance features
• Thinking access control handles backups
• Believing access control formats data display

2. Which MySQL command is used to give a user permission to access a database?

easy

A. SELECT

B. REVOKE

C. GRANT

D. DELETE

Solution

1. Step 1: Recall MySQL commands for permissions

   GRANT is used to give permissions; REVOKE removes them.

2. Step 2: Identify the command that grants access

   GRANT assigns privileges to users to access or modify data.

3. Final Answer:

   GRANT -> Option C

4. Quick Check:

   GRANT = Give permission [OK]

Hint: GRANT gives access, REVOKE removes it [OK]

Common Mistakes:

• Confusing GRANT with REVOKE
• Choosing data manipulation commands like SELECT or DELETE
• Thinking SELECT grants permissions

3. Given the commands:
GRANT SELECT ON employees TO 'user1'@'localhost';
REVOKE INSERT ON employees FROM 'user1'@'localhost';
What can 'user1' do on the employees table?

medium

A. No permissions at all

B. Only select (read) data from employees

C. Both select and insert data

D. Insert new data but cannot read data

Solution

1. Step 1: Analyze the GRANT command

   GRANT SELECT allows user1 to read data from employees table.

2. Step 2: Analyze the REVOKE command

   REVOKE INSERT removes insert permission, so user1 cannot add data.

3. Final Answer:

   Only select (read) data from employees -> Option B

4. Quick Check:

   GRANT SELECT + REVOKE INSERT = Read only [OK]

Hint: GRANT adds, REVOKE removes permissions [OK]

Common Mistakes:

• Assuming REVOKE removes all permissions
• Thinking user1 can insert data
• Confusing SELECT with INSERT permission

4. A database admin runs:
GRANT SELECT ON sales TO 'user2'@'%';
REVOKE SELECT ON sales FROM 'user2'@'%';
But user2 can still read the sales table. What is the likely problem?

medium

A. User2 has SELECT permission from another host or user entry.

B. The REVOKE command syntax is incorrect.

C. MySQL does not support REVOKE for SELECT.

D. User2 needs to restart the database to update permissions.

Solution

1. Step 1: Understand permission scope in MySQL

   Permissions are granted per user and host combination.

2. Step 2: Identify why REVOKE may not work as expected

   If user2 has another entry with SELECT permission from a different host, that permission remains.

3. Final Answer:

   User2 has SELECT permission from another host or user entry. -> Option A

4. Quick Check:

   Multiple user entries can override REVOKE [OK]

Hint: Check all user@host entries for permissions [OK]

Common Mistakes:

• Assuming REVOKE syntax is wrong without checking user entries
• Believing REVOKE is unsupported for SELECT
• Thinking a database restart is needed for permission changes

5. You want to ensure only the HR team can update employee salaries in MySQL. Which approach best protects this sensitive data?

hard

A. Grant all permissions to everyone and rely on application checks.

B. Allow all users to SELECT and UPDATE salaries for transparency.

C. Do not use any access control and trust users to behave.

D. Grant UPDATE permission on salaries table only to HR users, revoke from others.

Solution

1. Step 1: Identify the need for restricted update access

   Only HR should modify salaries to protect sensitive data.

2. Step 2: Apply access control best practice

   Grant UPDATE permission only to HR users and revoke from others to enforce this.

3. Final Answer:

   Grant UPDATE permission on salaries table only to HR users, revoke from others. -> Option D

4. Quick Check:

   Restrict update rights to protect sensitive data [OK]

Hint: Limit update rights to trusted users only [OK]

Common Mistakes:

• Giving update rights to all users
• Relying only on application-level checks
• Ignoring access control for sensitive tables