Creating a user account is only the first step. By default, a newly created MySQL user has zero privileges and cannot even view or query user databases.
The GRANT statement assigns specific operational permissions to user accounts at granular levels: Global, Database, Table, or Column.
Privilege Levels in MySQL
MySQL's privilege hierarchy operates on four distinct scopes:
1
*Global Level (`.`):* Privileges apply to all databases on the MySQL server (e.g., SUPER, RELOAD, SHUTDOWN).
2
*Database Level (`db_name.):** Privileges apply to all tables within a specific database (e.g., SELECT, INSERT, CREATE, DROP`).
3
Table Level (db_name.table_name): Privileges apply strictly to a single designated table.
4
Column Level (SELECT (col1, col2) ON db.table): Privileges apply strictly to specified columns within a table.
The GRANT Statement Syntax
1GRANT privilege_list
2ON database_name.table_name
3TO'username'@'hostname'
4[WITHGRANTOPTION];
Practical Real-World GRANT Scenarios
Scenario 1: Read-Only Reporting Analyst
1-- Grant read-only SELECT on all tables in ecommerce database
2GRANTSELECT
3ON ecommerce.*
4TO'bi_analyst'@'192.168.10.%';
Scenario 2: Web Application Backend
Backend application servers usually require CRUD operations on tables, but should never have permissions to drop tables or databases:
1GRANTSELECT,INSERT,UPDATE,DELETE,EXECUTE
2ON ecommerce.*
3TO'webapp'@'localhost';
Scenario 3: Column-Level Masking
Suppose an external contractor needs to update inventory prices, but should not see cost margins: