Back
Syntax
Study
Editor
Mode:
HTML
CSS
JavaScript
PHP
Reset
Run »
HTML / CSS / JS
-- SQL: create least-privilege database users for different app roles -- Read-only reporting user CREATE USER 'app_reporter'@'10.0.1.%' IDENTIFIED BY 'StrongPassHere!'; GRANT SELECT ON myapp.* TO 'app_reporter'@'10.0.1.%'; -- Application CRUD user (no DROP, no GRANT) CREATE USER 'app_web'@'10.0.1.%' IDENTIFIED BY 'AnotherStrongPass!'; GRANT SELECT, INSERT, UPDATE, DELETE ON myapp.* TO 'app_web'@'10.0.1.%'; -- Migration user (used only during deployments) CREATE USER 'app_migrate'@'127.0.0.1' IDENTIFIED BY 'MigrationPass!'; GRANT ALL PRIVILEGES ON myapp.* TO 'app_migrate'@'127.0.0.1'; -- Revoke after migration: DROP USER 'app_migrate'@'127.0.0.1'; -- Verify grants SHOW GRANTS FOR 'app_web'@'10.0.1.%'; -- PHP: connect with the least-privilege web user // $pdo = new PDO( // 'mysql:host=db.internal;dbname=myapp', // 'app_web', // getenv('DB_PASS_WEB'), // [PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION] // );
Result
Open