• 0

Should I create a unique MySQL user per logged in person?


Question

Yo Neowin!

I want to know what do you suggest in terms of security, and speed, whether is recommended or not to create an individual user for each person that logs in to my site.

I mean. I usually verify a username on a table, and assign unique tables to each of my users with a General MySQL user account with limited privileges. But since I've been reading a little bit more about MySQL (I only know the basics), I've seen that to improve security I could assign certain limits on MySQL users and only allow access to certain tables.

So, what can you suggest me in terms of MySQL users?

Thanks :p

14 answers to this question

Recommended Posts

  • 0
  On 04/01/2013 at 14:01, SuperKid said:

What do you mean unique mysql user per logged in user, what type of site is this?

I mean, to create a MySQL user. The default user on a MySQL server is root. I would like to know if it would improve security having a separate user like "John" which would only access Joh_products and John_clients table and will have limited privileges like SELECT, DROP, UPDATE, INSERT commands.

This site, is on development right now, so everything can be modified. It's a receipt management website, which each of the users will have their own clients stats, number of purchases, receipts, etc.

  • 0
  On 04/01/2013 at 14:06, Jose_49 said:

I mean, to create a MySQL user. The default user on a MySQL server is root. I would like to know if it would improve security having a separate user like "John" which would only access Joh_products and John_clients table and will have limited privileges like SELECT, DROP, UPDATE, INSERT commands.

This site, is on development right now, so everything can be modified. It's a receipt management website, which each of the users will have their own clients stats, number of purchases, receipts, etc.

I truly would not recommend that at all.

  • 0

NEVER use the root account AT ALL once you've configured the MySQL server, make another account and grant it root-like permissions and ONLY use the root account as a last resort if something breaks to restore everything.

Yes use different accounts for different sites, one account for all clients on one site should be fine i.e. one account for this receipt tracking site, another account for a control panel site, etc.

  • 0

You should only really need one master user for the mysql database itself. Then use web based forms (in PHP for example) to allow the people to add/delete/update their data. They don't need to have direct access to the database tables to do this. I don't really see the point of having totally distinct tables for each user either. Seems like a lot of duplication and you'll end up with a massive amount of tables.

  • 0

Thanks to all of the above. Now I have a clear mind.

  On 04/01/2013 at 14:15, n_K said:

NEVER use the root account AT ALL once you've configured the MySQL server, make another account and grant it root-like permissions and ONLY use the root account as a last resort if something breaks to restore everything.

Yes use different accounts for different sites, one account for all clients on one site should be fine i.e. one account for this receipt tracking site, another account for a control panel site, etc.

I shall take this recommendation then :)

  On 04/01/2013 at 14:28, technikal said:

I don't really see the point of having totally distinct tables for each user either. Seems like a lot of duplication and you'll end up with a massive amount of tables.

:/ There was no other way my logic could function.

I Googled a bit and found that there wasn't any problem having multiple tables. The thing is that it allows flexibility. I didn't see a good way on putting the client info, the receipt #, the quantity, price of the product purchased (because it has a variable price), the current product id, the tax, and whether it was paid, delivered or not. So I could fetch it in a productive way later on....

Anyways, I'm open to suggestions :D

  • 0
  On 04/01/2013 at 15:48, Jose_49 said:

I Googled a bit and found that there wasn't any problem having multiple tables. The thing is that it allows flexibility. I didn't see a good way on putting the client info, the receipt #, the quantity, price of the product purchased (because it has a variable price), the current product id, the tax, and whether it was paid, delivered or not. So I could fetch it in a productive way later on....

Multiple tables are fine, in fact you should be using multiple tables, but there's a much better and organized way of using them. You should be using different tables for storing types of data. If I have Users, Customers, and Receipts; I would create a separate table for each one of them. Then I would create two additional tables used for associations, one for Users->Receipts, and one for Customers->Receipts. These associative tables would only store the unique id's for the rows in the other tables.

Not sure if I explained clear enough or not, also not sure if it's quite the same idea as your system. Either way its best to have different table's for different types of data, since there's no sense in storing the same data multiple times.

  • 0

Certainly use multiple tables, but not for each user. Say you have 10 users and each user has a separate table, if you want to see all the data from all the users you have to search through 10 tables, vs. just the main table for the type of data you want.

So instead of userA_orders, userB_orders, etc. you just have a single orders table, and store what user created the order in the record you insert into the table.

  • 0

if i've read this right. you should create a function user. one user that can insert, update, or delete records, but not modify the database structure. use that user for any transaction, and the root as a last resort.

  • 0
  On 05/01/2013 at 06:34, mollick2 said:

Multiple tables are fine, in fact you should be using multiple tables, but there's a much better and organized way of using them. You should be using different tables for storing types of data. If I have Users, Customers, and Receipts; I would create a separate table for each one of them. Then I would create two additional tables used for associations, one for Users->Receipts, and one for Customers->Receipts. These associative tables would only store the unique id's for the rows in the other tables.

Not sure if I explained clear enough or not, also not sure if it's quite the same idea as your system. Either way its best to have different table's for different types of data, since there's no sense in storing the same data multiple times.

  On 05/01/2013 at 06:44, The_Decryptor said:

Certainly use multiple tables, but not for each user. Say you have 10 users and each user has a separate table, if you want to see all the data from all the users you have to search through 10 tables, vs. just the main table for the type of data you want.

So instead of userA_orders, userB_orders, etc. you just have a single orders table, and store what user created the order in the record you insert into the table.

Now I get it! Yup. Indeed. I know my logic was failing somewhere.

I just need to create a separate column with the current logged in user, and bang it with a WHERE clause to identify the user (*poker face*)

Aaaargh.

Going to work on it right now

Thank you people :D

This topic is now closed to further replies.
  • Posts

    • Let me guess, just big hyped cut scenes for what is really just more run around in the same old static urban zone machine gun vs. sniper game play.
    • I am not seeing a huge difference there.
    • This is what I came here to say even if just for a dedicated Windows PC gaming box. Gaming is the only use case have to use Windows these days.
    • The Outer Worlds 2 gets an October release date, reveals companion details by Pulasthi Ariyasinghe After Avowed, Obsidian Entertainment's next grand RPG was already revealed to be releasing in 2025, but during the Xbox Games Showcase today, it finally received a firm release date: October 29. Check out the new story trailer above. While the original was set in Halcyon, this time, the story is set in Arcadia, a brand-new setting that's described as a lawless frontier. Also cut off from Earth, this land is pressured by human conflicts as well as mysterious space-time rifts. "You’ve been sent in as an Earth Directorate agent, but how you handle the mission – who you help, hinder, or exploit – is entirely your call," says Obsidian today. "Build your character with expanded traits, flaws, and backgrounds that shape every decision and unlock new ways to fight, sneak, talk, or blow things up." The RPG will let players get involved with three clashing factions this time: The Protectorate, Auntie’s Choice, and The Order of the Ascendant. Each of them is attempting to advance their own version of humanity's optimal future. Each of these factions has tout own hub areas, followers, audio design, and propaganda elements, with the war between the trio changing all of these as the story progresses depending on player choices. "RPG systems have been reimagined for this sequel to give players more freedom and more flavor," adds the company. "For example, traits and flaws dynamically evolve based on how you play. Steal enough and you’ll be offered Kleptomaniac, which boosts loot sales but risks auto-theft when you so much as glance at an item." Obsidian also detailed the companions players will be able to meet and ally with in their journeys: Niles: Another Earth Directorate recruit torn between duty and defection. Inez: A former experiment from Auntie’s Choice with a grafted combat edge and a moral core. Aza: A chaos-loving Rift worshipper with a taste for violence and room to grow – maybe. Marisol: A stoic killer from the Order of the Ascendant with calculations to settle. Tristen: A walking tank and judge from the Protectorate, looking to dispense justice – or redefine it. Valerie: A floating, chirping support unit with unexpected upgrades and untapped potential. The Outer Worlds 2 is releasing on October 29, 2025 across PC, Xbox Series X|S, and PlayStation 5. As usual for an Xbox game, it will be available to Game Pass subscribers on day one for no extra cost. Don't forget that Obsidian also has Grounded 2 releasing next month into early access too.
    • I love space RPGs, and this one will no doubt scratch that itch. Im still modding the crap out of Starfiled. Can't wait.
  • Recent Achievements

    • Reacting Well
      BlakeBringer earned a badge
      Reacting Well
    • Reacting Well
      Lazy_Placeholder earned a badge
      Reacting Well
    • Dedicated
      Epaminombas earned a badge
      Dedicated
    • Veteran
      Yonah went up a rank
      Veteran
    • First Post
      viraltui earned a badge
      First Post
  • Popular Contributors

    1. 1
      +primortal
      471
    2. 2
      +FloatingFatMan
      265
    3. 3
      ATLien_0
      235
    4. 4
      snowy owl
      224
    5. 5
      Edouard
      174
  • Tell a friend

    Love Neowin? Tell a friend!